7. Network Security Fundamentals

Network administrators can utilize network security tools

Unapproved Web sites can be restricted based on the URL or by matching keywords

Can be a security risk

Determine which device is connected to each port

detect

Finds malicious traffic and deals with it immediately

Usually located outside the network security perimeter as first line of defense

Rarely used today

All log data is stored locally

Allows administrators to hide internal network layout

img 2

Port mirroring can happen to

MAC Flooding can happen to

MAC address impersenation can happen to

Usually located outside network security perimeter

a router's primary function is addressing

Reduced costs (cache reduces bandwidth required)

Can forward frames sent to that specific device

Can be configured to filter out specific types of network traffic

Details reporting is a feature of

A protocol analyzer is hardware only hat captures packets to decode and analyze its contents

Typically used to filter packets

Use MAC address to identify devices

Stateless packet filtering and Stateful packet filtering

Increase network traffic

A computer or an application program that intercepts a user request ...

Connect multiple Ethernet devices together

Run their own OS

Forward packets across computer networks

Malware filtering is a feature of

Can recognize unauthorized Registry modification

IP address may be split anywhere within its 32 bits

Provides an additional level of security that is proactive instead of reactive

Designed to prevent malicious packets from entering the network

Network tap and ____ with Port mirroring

The basis of a _____ is a rule base.

Improved management  Block specific Web pages or sites

Increased speed (requests served from the cache)

Intended to trap or trick attackers

Network tap can happen to

Workgroup switches must work faster than core switches

Protects users by preventing malware from connecting to other computers and spreading

connects network segments

A device that installed between two network devices

HIDS and NIDS

perform security analysis.

Monitor Internet traffic and block access to preselected Web sites and files

Examine attacker techniques

Masks IP addresses of internal devices

Installed on each system needing protection

Allow scattered users to be logically grouped together even if attached to different switches

ARP poisining can happen to

Core switches and Workgroup switches

Hubs provide more security than switches

are connected directly to the devices on the network

Outgoing packets given same IP address but different TCP port number

A requested Web page is only displayed if it complies with the specified filters

The security functions of standard network devices can't be used to provide network security

Use a switch that can close ports with too many MAC addresses

Replaces private IP address with public address

Can be expensive

Copies all traffic to a designated monitoring port on the switch

Hide client system’s IP address from the open Internet

URL and content filtering is a feature of

are widely used by network administrators for monitoring a network

Similar to active NIDS

Intercept malware

The solution to it is physical

Do not read any of the data passing through them

Improves network security by isolating groups of hosts

Resource-intensive and can slow system

Installed on each system needing protection ...

Keeps a record

It is only as strong as the operating system of the computer

Configure the switch so that only one port can be assigned per MAC addresses

Ignore the source and destination of incoming frames

Monitors system calls and file system access

Separate network located outside secure network perimeter

It attempts to identify inappropriate behavior (against normal behavior

Watches for attempts to penetrate a network

Cannot monitor network traffic that does not reach local system

HIPS and NIPS

Deflect attention

installed on firewalls and routers

Early warnings of new attacks

Not all applications designed, written with security in mind

Allows multiple devices to share smaller number of public IP addresses

Allows private IP addresses to be used on the public Internet

A computer typically located in a DMZ that is loaded with data that appear to be authentic

Single firewall and Two firewalls

Profiles is a feature of

A firewall can be software-based or hardware-based

Looks at the incoming packet and permits or denies it based strictly on the rule base

Prohibit file downloads is a feature of

img 1

Sometimes called a packet filter

reside at the top of the hierarchy and carry traffic between switches

response may be to block all incoming traffic on a specific port