>> Welcome to Module 2,
Lesson 1, network security architecture part 1.
The learning objectives for
this lesson are to demonstrate
how intrusion detection and
>> prevention aid in insecurity,
>> describe the types of perimeter security devices,
and the utilize sensors on
>> a network to improve security.
>> Let's get started. An intrusion detection system
also known as IDS,
is basically an alarm system for your network.
We have two broad types of
intrusion detection systems and these
are host-based and network-based.
The key point to remember about
an intrusion detection system is that
it just monitors and alerts for signs of an attack.
It's not going to take any action on any of the alerts
that happen other than letting
>> you know that it happened.
>> All intrusion detection systems make use of
the following three analysis techniques.
These are signature-based which
works like antivirus where it has
a database of signatures and if something
matches one of those signatures, it will trigger.
Anomaly-based,
looking for things that are out of the ordinary,
and behavior-based which is very similar,
it monitors a baseline of
what behavior is normal on a network or a device,
and when it sees things that are outside of
that normal behavior then it will trigger an alert.
We also have wireless intrusion
detection systems or WIDS.
These devices are looking
for attacks on a wireless network.
For example, looking for
rogue access points or evil twins,
looking for devices that are on
the network that are not supposed to be there,
any signs of a denial of service
attack or also MAC address spoofing.
The device in the top right is a Hak5 WiFi Pineapple.
These devices are purpose-built to perform these
types of attacks for penetration testing on a network.
The device in the bottom is a pocket Deauther.
This device can send
the authorization frames to
a wireless access point to kickoff clients.
When those clients re-establish
then the handshake is captured,
this can be taken offline and cracked,
and then you have the password for the network.
It can also be used as
a denial-of-service attack device
blocking all clients from connecting to a network.
Intrusion prevention systems or
IPS take this a step further.
They do the same thing as an intrusion detection system,
but once something is detected,
they will take action on it.
For example, they can reset
connections or even block traffic altogether.
The key point to remember about
an intrusion prevention system is
that it must be placed
inline on the network to monitor traffic.
If it can't see all of the traffic on the network,
then it can't take action when it detects something.
Wireless intrusion prevention systems can
go as far as to block different clients from
being on the network and
stopping denial of service attacks.
Traffic mirroring, this is also
known as port mirroring or SPAN ports.
This is where you allow
another switch port to
intercept all of the traffic on the switch.
On switches, traffic typically goes to one port
only so if you want to
see all the traffic that's going through the switch,
you have to build a mirror using something like this.
This allows you to sniff all the traffic on the network,
you could run it through a protocol analyzer
such as Wireshark or
pipe it into your network intrusion detection system
so that they can see everything.
Perimeter security devices. The first one,
you probably all are familiar with is a router.
A router in its most basic sense,
forge traffic from one network to
another by checking IP addresses.
But in doing that,
it is able to determine
should this traffic be forwarded,
should it be blocked, should it be sent somewhere else?
We can do that with access control list.
Routers are often a first-line inside the network
of defense by preventing
traffic from going to different places.
Load balancers inspect the incoming web traffic,
and then it will redirect it to
the available web servers behind it.
This is usually associated with
availability and fault tolerance.
Network address translation.
If you're using a router at your house,
maybe the one that your internet
service provider gave you,
or you bought a Linksys or that type of device,
then you're probably using NAT.
Network address translation allows
you to have a private subnet behind the device.
These are the IP addresses that
we're all familiar with seeing
, 192.168.0.0.0 type networks.
The NAT will translate those private addresses into
the WAN address and allow it to go out on the Internet.
But on the Internet side,
it only appears as if you have one IP
address being your WAN public IP address.
Forward and transparent proxy.
The key to remember about these is that
they are working from inside the network out.
When a client on the inside of
the network wants to go to a particular webpage,
they first go to the proxy,
and then the proxy will request
that for the client and send it back.
Everything is routed through the proxy.
This allows the proxy to intercept
the traffic and see if there's anything malicious in it,
but it also allows it to deny clients access to
sites that may not be
approved for those clients to surf to.
Proxies also have to
understand the protocol that
they're going to be handling.
Multipurpose proxies can handle
several protocols such as HTTP, FTP, and SMTP.
A reverse proxy is the exact opposite.
This is for traffic on the outside
of the network coming in.
It can be used to improve performance of
a website because it can cache data
and send the data faster to clients.
It's in line with traffic,
and it has to be between the clients,
the requesting server going from the outside in.
Reverse proxies are outside in,
transparent proxies are inside out.
Firewalls. At its most basic level,
a firewall is a device that
filters traffic that passes through it.
This is done by looking at the source of the traffic,
the destination, the protocol,
and the ports that it wants to go to.
From there, the firewall will make a decision
on what it needs to do with that particular traffic.
For example, if we have a website that's
open on port 80 behind the firewall,
the firewall may allow all traffic to port 80 to be
forwarded over to that IP address
of the webserver behind the firewall.
It's really good for doing this type of direct traffic,
sending to a particular server,
or blocking everything based on rules.
But if you want something more complex such as looking
at the actual content of the traffic coming through,
you need a more robust device.
That brings us to a unified threat management system.
UTMs add additional capability
to firewalls with content filtering,
spam filtering, antivirus scanning,
and traffic and web filtering.
This is where the industry has moved to,
these are the devices that we're most likely to be seeing
now is they're more capable of
defending a network than a standard firewall.
You also have next-generation firewalls that are
able to inspect higher-level protocols
such as HTTP so that they can look
inside the packets and see if there's anything malicious.
Once they inspect the traffic,
if there is anything malicious,
then they can drop it based
on the content of the data itself.
We also have web application firewalls or WAFs.
These act as a shield to a website;
they're very specific for protecting web servers
from a wide range of attacks.
But some examples would be SQL injection,
cross-site scripting, cross-site request forgery,
file inclusions, and directory transversal.
There are quite a number of attacks that
these can protect from but these are the most common.
We have three basic types of WAF devices.
The first is network-based,
is a separate host or it could be a virtual machine
that sits in front of the website that it's protecting.
These are the most expensive,
but they offer the most flexibility.
Host-based is software that
runs on the actual web server itself,
and it's very inexpensive.
In fact, some case is free like the example of
ModSecurity but it means it's
very complicated to get configured.
The last is Cloud-based,
and it's delivered by a Cloud service provider.
It's less expensive,
and it offers expert implementation
with low maintenance since
the Cloud service provider is usually
the one implementing and maintaining it for you.
>> Virtual Private Networks.
If you watch any YouTube videos,
you've seen advertisements for these.
But the most basic use of
a virtual private network is to
connect two networks together.
So if you have a remote office in
one city and the main office in another,
you can create a virtual private network,
which is an encrypted tunnel between the two,
allowing the two networks to be able to
communicate with each other securely across the Internet.
Another common use of a VPN
is for remote workers to connect back to the main office.
With a pandemic that occurred in 2020,
a lot of workers were shifted home to do
their work and this
was the way they were all able to connect.
Again, was using a virtual private network.
Here are some common VPN protocols.
OpenVPN, L2TP teamed up with IPSec,
IKEA teamed up with IPSec,
WireGuard, SSTP, IPSec, and PPTP.
Network Access Control.
These devices create a baseline for
what every device that's connected
to the network should adhere to.
So for example, patch level must have
an anti-virus program that's on
the excepted list and it must be updated.
Maybe you have to have a host firewall enabled.
When a device is plugged into the network,
if it doesn't meet the standards,
it will not allow the device to connect.
This way you're only allowing
access to the network, to trusted devices.
System Information and Event Management, or SIEM.
These are devices that collect
data from multitude of sources on your network.
For example, it may collect data from your firewall,
your endpoints, your domain controllers,
and many other types of devices and bring them
all into one source and then look
at all of that data at
one time to spot patterns of an attack.
So for example, seeing
one failed user login
on one machine might not be a big deal.
But if it happened across 20 machines at the same time,
that might be an indicative of an attack.
The SIEM would be able to take all of that data in
and then alert you to it
so that you can take further action.
SIEM typically have the following functions
that aggregation, correlation, alerting,
visibility, compliance, and data retention.
Activity and traffic sensors,
NetFlow, and S flow.
These are network protocols for
capturing network traffic for analysis.
We also have fallen integrity monitoring.
This ensures that the files on
different devices or endpoints haven't changed.
This is looking for signs of a malicious attack,
where an attacker would come in and
make changes to specific system files,
such as DLL files on Windows machines.
A file integrity monitoring system
ensures that hasn't been done.
Simple Network Management Protocol, SNMP.
This operates on UDP ports 161 and 162.
This is a very common system for
monitoring and managing network infrastructure.
Switches, routers, firewalls,
and sometimes even actual workstations will have SNMP.
It consists of two parts,
which are the monitors and the agents.
If you're not using SNMP on
your network or if a device doesn't need it,
it's highly recommended that you
disable it because a lot of information can be
gleaned from querying an SNMP daemon
that's running on a particular system.
Data loss prevention or DLP.
This is software that's designed to
protect the data that's on a network.
Once the sensitive data on a network has been defined,
you can allow different levels of
access on that data and who is allowed to access it,
and then what they're able to do with it,
for example, are they able to print?
Are they able to copy it?
Are they able to email it? That type of thing.
We can set these rules up for all users to ensure
that data is not exfiltrated from the network improperly.
Distributed Denial of Service Protection.
This has become a massive problem in
our industry where different websites are under attack,
and there are some things we can do about
it to help prevent those attacks from
causing outages of our web resources.
The first one we can do is rate-limiting,
which reduces the amount of
throughput that goes to the server.
So that way the total
bandwidth is not actually being used.
We can put a web application firewall in
line to prevent the traffic
from actually reaching the webserver.
We can do black hole routing,
which drops all inbound traffic
that is destined to the endpoint,
in this case, a web server.
We can use cloud service providers like
Cloudflare that route all traffic.
We ran all traffic through them first and then
they handle it before it ever reaches our website.
We can also use
a DDoS mitigation software or an appliance,
which is a purpose-built device to help
us prevent this type of attack on our web servers.
Let's summarize what we went over in this lesson.
We went over how intrusion
detection intrusion prevention systems work.
We went over a wireless intrusion
detection and prevention systems.
We discussed perimeter security
devices such as firewalls,
proxies, routers, and VPNs.
We also went over using sensors to collect
data from the network to improve network security.
Let's look at some example questions.
Which technology solution would you need to
implement to prevent rogue access points on
a network or
wireless intrusion prevention system or a WIPS?
Question 2, you
have been asked to provide a solution to help
a company prevent its confidential and
proprietary information from being copied,
printed, or used improperly.
What type of technology would you recommend?
A data loss or DLP system?
Example 3, what tool must be placed in
line to allow a NIDS to inspect all network traffic?
A sniffer.
What is the purpose of a SIEM?
To aggregate logs from a variety of systems and
provide real-time alerting based on the collected data.
Well, that brings us to the end of Module 2, Lesson 1.
I hope this was helpful for you and explained
everything in enough detail that
you can pass the exam. Thank you.