Engineering-Computing Academy of
Science and Technology
BSIT
I
Course Code IAS 2612
Course Description Information Assurance and Security
Module Title Network Security and Intrusion Detection
I. INTRODUCTION:
A system called an intrusion detection system (IDS) observes network traffic for malicious
transactions and sends immediate alerts when it is observed. It is software that checks a
network or system for malicious activities or policy violations. Each illegal activity or violation is
often recorded either centrally using a SIEM system or notified to an administration. IDS
monitors a network or system for malicious activity and protects a computer network from
unauthorized access from users, including perhaps insiders. The intrusion detector learning task
is to build a predictive model (i.e. a classifier) capable of distinguishing between ‘bad
connections’ (intrusion/attacks) and ‘good (normal) connections’.
II. PRE- DISCUSSION ACTIVITY:
In your own words (2-3 sentences each number) define the following:
1. Cryptography
2. Security
Engineering-Computing Academy of
Science and Technology
BSIT
I
[Link]: CHAPTER 3” Network Security”
Network Security
Refers to the measures taken by any enterprise or organization to secure its
computer network and data using both hardware and software systems. This
aims at securing the confidentiality and accessibility of the data and network.
Every company or organization that handles a large amount of data, has a
degree of solutions against many cyber threats.
The most basic example of Network Security is password protection which the
user of the network oneself chooses. In recent times, Network Security has
become the central topic of cyber security with many organizations inviting
applications from people who have skills in this area. The network security
solutions protect various vulnerabilities of the computer systems such as:
1. Users
2. Locations
3. Data
4. Devices
Benefits of Network Security
Network Security has several benefits, some of which are mentioned below:
Engineering-Computing Academy of
Science and Technology
BSIT
I
1. Network Security helps in protecting clients’ information and data which
ensures reliable access and helps in protecting the data from cyber
threats.
2. Network Security protects the organization from heavy losses that may
have occurred from data loss or any security incident.
3. It overall protects the reputation of the organization as it protects the data
and confidential items.
Working on Network Security
The basic principle of network security is protecting huge stored data and
networks in layers that ensure the bedding of rules and regulations that have to
be acknowledged before performing any activity on the data.
These levels are:
1. Physical Network Security
2. Technical Network Security
3. Administrative Network Security
These are explained below:
1. Physical Network Security: This is the most basic level that includes
protecting the data and network through unauthorized personnel from
acquiring control over the confidentiality of the network. These include external
peripherals and routers that might be used for cable connections. The same can
be achieved by using devices like biometric systems.
Engineering-Computing Academy of
Science and Technology
BSIT
I
2. Technical Network Security: It primarily focuses on protecting the data
stored in the network or data involved in transitions through the network. This
type serves two purposes. One is protected from unauthorized users, and the
other is protected from malicious activities.
3. Administrative Network Security: This level of network security protects
user behavior like how the permission has been granted and how the
authorization process takes place. This also ensures the level of sophistication
the network might need for protecting it through all the attacks. This level also
suggests necessary amendments that have to be done to the infrastructure.
Types of Network Security
The few types of network securities are discussed below:
1. Access Control
2. Antivirus and Anti-Malware Software
3. Email Security
4. Firewalls
5. Application Security
6. Intrusion Prevention System(IPS)
1. Access Control: Not every person should have a complete allowance for the
accessibility to the network or its data. One way to examine this is by going
through each personnel’s details. This is done through Network Access Control
Engineering-Computing Academy of
Science and Technology
BSIT
I
which ensures that only a handful of authorized personnel must be able to work
with the allowed amount of resources.
2. Antivirus and Anti-malware Software: This type of network security ensures
that any malicious software does not enter the network and jeopardize the
security of the data. Malicious software like Viruses, Trojans, and Worms is
handled by the same. This ensures that not only the entry of the malware is
protected but also that the system is well-equipped to fight once it has entered.
3. Email Security: Email Security depicts the services, and products designed to
protect the Email Account and its contents safe from external threats. For
Example, you generally see, fraud emails are automatically sent to the Spam
folder. because most email service providers have built-in features to protect the
content.
4. Firewalls: A firewall is a network security device, either hardware or software-
based, which monitors all incoming and outgoing traffic and based on a defined
set of security rules accepts, rejects, or drops that specific traffic. Before
Firewalls, network security was performed by Access Control Lists (ACLs)
residing on routers.
Engineering-Computing Academy of
Science and Technology
BSIT
I
5. Application Security: Application security denotes the security precautionary
measures utilized at the application level to prevent the stealing or capturing of
data or code inside the application. It also includes the security measurements
made during the advancement and design of applications, as well as techniques
and methods for protecting the applications whenever.
6. Intrusion Prevention System(IPS): An intrusion Prevention System is also
known as Intrusion Detection and Prevention System. It is a network security
application that monitors network or system activities for malicious activity. The
major functions of intrusion prevention systems are to identify malicious activity,
collect information about this activity, report it, and attempt to block or stop it.
IPSec
IPsec is a group of protocols for securing connections between devices. IPsec
helps keep data sent over public networks secure. It is often used to set up
Engineering-Computing Academy of
Science and Technology
BSIT
I
VPNs, and it works by encrypting IP packets, along with authenticating the
source where the packets come from.
IPSec is a set of communication rules or protocols for setting up secure
connections over a network. Internet Protocol (IP) is the common standard
that determines how data travels over the internet. IPSec adds encryption
and authentication to make the protocol more secure.
Tunnel Mode
In tunnel mode, the entire original IP packet is encapsulated to become the
payload of a new IP packet. Additionally, a new IP header is added on top of the
Engineering-Computing Academy of
Science and Technology
BSIT
I
original IP packet. Since a new packet is created using the original information,
tunnel mode is useful for protecting traffic between different networks. An
additional advantage of this mode is that it makes it very easy to establish a
“tunnel‚ between two secure IPsec gateways.
Transport Mode
The main difference in transport mode is that it retains the original IP header. In
other words, payload data transmitted within the original IP packet is protected,
but not the IP header. In transport mode, encrypted traffic is sent directly
between two hosts that previously established a secure IPsec tunnel.
Key Management
Manual system administrator manually configures each system with its own keys
and with the keys of another communicating systems.
Automatic, an automated system enables the on-demand creation of keys and
facilities the use of keys. Used in large system configuration.
CHAPTER 4” Intrusion Detection”
An intrusion detection system (IDS) is a system that monitors network traffic
for suspicious activity and alerts when such activity is discovered.
Engineering-Computing Academy of
Science and Technology
BSIT
I
While anomaly detection and reporting are the primary functions of an IDS, some
intrusion detection systems are capable of taking actions when malicious activity
or anomalous traffic is detected, including blocking traffic sent from suspicious
Internet Protocol (IP) addresses.
An IDS can be contrasted with an intrusion prevention system (IPS), which
monitors network packets for potentially damaging network traffic, like an IDS,
but has the primary goal of preventing threats once detected, as opposed to
primarily detecting and recording threats.
How do intrusion detection systems work?
Intrusion detection systems are used to detect anomalies with the aim of
catching hackers before they do real damage to a network. IDSes can be either
network- or host-based. A host-based intrusion detection system is installed on
the client computer, while a network-based intrusion detection system resides on
the network.
Intrusion detection systems work by either looking for signatures of known
attacks or deviations from normal activity. These deviations or anomalies are
pushed up the stack and examined at the protocol and application layer. They
Engineering-Computing Academy of
Science and Technology
BSIT
I
can effectively detect events such as Christmas tree scans and Domain Name
System (DNS) poisonings.
An IDS may be implemented as a software application running on customer
hardware or as a network security appliance. Cloud-based intrusion detection
systems are also available to protect data and systems in cloud deployments.
Different types of intrusion detection systems
IDSes come in different flavors and detect suspicious activities using different
methods, including the following:
A network intrusion detection system (NIDS) is deployed at a strategic point
or points within the network, where it can monitor inbound and outbound traffic to
and from all the devices on the network.
A host intrusion detection system (HIDS) runs on all computers or devices in
the network with direct access to both the internet and the enterprise's internal
network. A HIDS has an advantage over an NIDS in that it may be able to detect
anomalous network packets that originate from inside the organization or
Engineering-Computing Academy of
Science and Technology
BSIT
I
malicious traffic that an NIDS has failed to detect. A HIDS may also be able to
identify malicious traffic that originates from the host itself, such as when the
host has been infected with malware and is attempting to spread to other
systems.
A signature-based intrusion detection system (SIDS) monitors all the packets
traversing the network and compares them against a database of attack
signatures or attributes of known malicious threats, much like antivirus software.
An anomaly-based intrusion detection system (AIDS) monitors network
traffic and compares it against an established baseline to determine what is
considered normal for the network with respect to bandwidth, protocols, ports
and other devices. This type often uses machine learning to establish a baseline
and accompanying security policy. It then alerts IT teams to suspicious activity
and policy violations. By detecting threats using a broad model instead of
specific signatures and attributes, the anomaly-based detection method
improves upon the limitations of signature-based methods, especially in the
detection of novel threats.
IV. ASSESSMENT:
1. Define Network Security
2. Define Intrusion Detection
Reference List:
Cloud Computing
[Link]
Engineering-Computing Academy of
Science and Technology
BSIT
I
Prepared by: Reviewed by: Recommending Approved:
Approval:
Justin Nichol P. Jane M. Fernandez Virgo Lopez Donna Padilla
Pasamonte Dean,E-Coast Vice President for Taguiba
Faculty,E-Coast Academics President