TECH CRUSH CYBERSECURITY TRACK

NETWORKING BASICS
A GUIDE TO NETWORK SECURITY
 NETWORKING BASICS

 Networking, or computer networking, is the process of connecting two or more

computing devices, such as desktop computers, mobile devices, routers or
applications, to enable the transmission and exchange of information and resources.

 The network infrastructure contains three categories of hardware

components, as shown in the figure:
• End devices
• Intermediate devices
• Network media
NETWORKING BASICS
 TYPES OF DEVICES ON A NETWORK

 An end device is a device that originates, receives, or processes data on a network. These
devices are the primary users or consumers of network services, such as sending or receiving
information over the network. Examples of end devices include:
 Computers (Desktops/Laptops): Used for accessing network resources, browsing the web, and
sending emails.

Smartphones/Tablets: Mobile devices that connect to networks for communication and

internet services.

Printers: Devices that receive data from computers to print documents.

Servers: Systems that store and manage network resources (like websites, databases, or
applications).

IP Phones: Devices used for voice communication over an IP network (VoIP).

 TYPES OF DEVICES ON A NETWORK

 An intermediary device is a network device that facilitates the flow of data

between end devices. These devices do not generate or consume data
themselves but are responsible for forwarding, directing, and controlling network
traffic to ensure that data reaches its intended destination. Examples of
intermediary devices include:
 Routers: Direct traffic between different networks.

Switches: Connect devices within the same network and forward data to the
correct destination.

Firewalls: Monitor and control the flow of traffic based on security rules.

Access Points: Provide wireless access to a wired network.

 NETWORK TYPES: LAN/WAN/MAN

 Local Area Networks (LANs): A LAN is a network infrastructure that provides

access to users and end devices in a small geographical area. A LAN is
typically used in a department within an enterprise, a home, or a small
business network.

 A WAN is a network infrastructure that provides access to other networks

over a wide geographical area, which is typically owned and managed by
a larger corporation or a telecommunications service provider.

 MAN (Metropolitan Area Network): Covers a city or campus, larger

than LAN but smaller than WAN.
 IP ADDRESSING

 What is an IP Address? :A unique identifier assigned to each device on a network to

allow communication. Like a phone number for devices.

IPv4: The most common version of IP (e.g., [Link]).

Made up of four numbers (each between 0-255), separated by periods.

IPv6: The newer version due to IPv4 exhaustion.

Uses a longer format (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334).

Public vs Private IP Addresses:

Public IP: Used to identify your device globally (on the internet).
Private IP: Used within internal networks (e.g., 192.168.x.x for LAN).
 THE OSI MODEL

 The OSI (Open Systems Interconnection) Model is a conceptual framework used to understand and
standardize network communication processes. It consists of seven layers, each with specific functions in the
data exchange process . Its key importance includes:

1. Standardization: The OSI model provides a universal set of standards that ensure different network devices
and systems from various vendors can communicate effectively, ensuring compatibility and interoperability.

2. Troubleshooting: By breaking down network communication into distinct layers, the OSI model helps
network engineers isolate issues and determine at which layer a problem is occurring. This makes
troubleshooting more systematic.

3. Modularity: Each layer in the OSI model operates independently, so updates or changes in one layer (e.g.,
new protocols or hardware) don't necessarily impact other layers. This modularity makes networks more
adaptable and scalable.

4. Enhanced Communication: The model simplifies complex communication processes, helping developers
and engineers collaborate more easily by understanding which layer handles which function.
OSI MODEL
 OSI MODEL

OSI Model - The Lower Layers The bottom four layers of the OSI model are often referred to as the
lower layers:
• Layer-4 – Transport layer
• Layer-3 – Network layer
• Layer-2 – Data-Link layer
• Layer-1 – Physical layer Protocols that operate at these layers control the end-to-end transport of
data between devices, and are implemented in both software and hardware.
OSI Model - The Upper Layers The top three layers of the OSI model are often referred to as the
upper layers:
• Layer-7 - Application layer
• Layer-6 - Presentation layer
• Layer-5 - Session layer Protocols that operate at these layers manage application-level functions,
and are generally implemented in software. The function of the upper layers of the OSI model can
be difficult to visualize. Upper layer protocols do not always fit perfectly within a layer, and often
function across multiple layers
OSI MODEL: PHYSICAL LAYER

 OSI Model - The Physical Layer (Layer-1) controls the signaling

and transferring of raw bits onto the physical medium.
 The Physical layer is closely related to the Data-link layer, as
many technologies (such as Ethernet) contain both datalink
and physical functions.
 The Physical layer provides specifications for a variety of
hardware: • Cabling • Connectors and transceivers • Network
interface cards (NICs) • Wireless radios • Hubs
 OSI MODEL: DATA LINK LAYER

 The Data-Link Layer is concerned with transporting data between networks, the Data-Link
layer (Layer-2) is responsible for transporting data within a network.
 The Data-Link layer consists of two sublayers: • Logical Link Control (LLC) sublayer •
Media Access Control (MAC) sublayer The LLC sublayer serves as the intermediary
between the physical link and all higher layer protocols. It ensures that protocols like IP
can function regardless of what type of physical technology is being used.
 Additionally, the LLC sublayer can perform flow-control and error checking, though such
functions are often provided by Transport layer protocols, such as TCP. The MAC sublayer
controls access to the physical medium, serving as mediator if multiple devices are
competing for the same physical link. Datalink layer technologies have various methods
of accomplishing this - Ethernet uses Carrier Sense Multiple Access with Collision
Detection (CSMA/CD), and Token Ring utilizes a token.
 OSI MODEL: NETWORK LAYER

 The network layer, or OSI Layer 3, provides services to allow end devices to exchange
data across networks. As shown in the figure, IP version 4 (IPv4) and IP version 6 (IPv6) are
the principle network layer communication protocols. Other network layer protocols
include routing protocols such as Open Shortest Path First (OSPF) and messaging
protocols such as Internet Control Message Protocol (ICMP)
 Network layer (Layer-3) controls internetwork communication, and has two key
responsibilities:
 • Logical addressing – provides a unique address that identifies both the host, and the
network that host exists on.
 • Routing – determines the best path to a particular destination network, and then routes
data accordingly.
 OSI MODEL: TRANSPORT LAYER

 OSI Model - The Transport Layer The Transport layer (Layer-4) is responsible for the reliable
transfer of data, by ensuring that data arrives at its destination error-free and in order.
Transport layer communication falls under two categories:
 • Connection-oriented – requires that a connection with specific agreed-upon
parameters be established before data is sent.
 • Connectionless – requires no connection before data is sent. Connection-oriented
protocols provide several important services:
 OSI MODEL: TRANSPORT LAYER

 • Segmentation and sequencing – data is segmented into smaller pieces for transport.
Each segment is assigned a sequence number, so that the receiving device can
reassemble the data on arrival.
 •Connection establishment – connections are established, maintained, and ultimately
terminated between devices.
 • Acknowledgments – receipt of data is confirmed through the use of
acknowledgments. Otherwise, data is retransmitted, guaranteeing delivery.
 • Flow control (or windowing) – data transfer rate is negotiated to prevent congestion. T
 he TCP/IP protocol suite incorporates two Transport layer protocols:
 • Transmission Control Protocol (TCP) – connection-oriented
 • User Datagram Protocol (UDP) - connectionless
 OSI MODEL: SESSION LAYER

 The Session layer (Layer-5) is responsible for establishing, maintaining, and

ultimately terminating sessions between devices. If a session is broken, this layer
can attempt to recover the session. Sessions communication falls under one of
three categories:
 • Full-Duplex – simultaneous two-way communication
 • Half-Duplex – two-way communication, but not simultaneous
 • Simplex – one-way communication Many modern protocol suites, such as
TCP/IP, do not implement Session layer protocols.
Connection management is often controlled by lower layers, such as the Transport
layer. The lack of true Session layer protocols can present challenges for high-
availability and failover. Reliance on lower-layer protocols for session management
offers less flexibility than a strict adherence to the OSI model.
 OSI MODEL: PRESENTATION LAYER

 The Presentation layer (Layer-6) controls the formatting and syntax of user data
for the application layer. This ensures that data from the sending application
can be understood by the receiving application. Standards have been
developed for the formatting of data types, such as text, images, audio, and
video.
 Examples of Presentation layer formats include: • Text - RTF, ASCII, EBCDIC •
Images - GIF, JPG, TIF • Audio - MIDI, MP3, WAV • Movies - MPEG, AVI, MOV
 If two devices do not support the same format or syntax, the Presentation layer
can provide conversion or translation services to facilitate communication.
Additionally, the Presentation layer can perform encryption and compression
OSI MODEL: APPLICATION LAYER

 The Application layer (Layer-7) provides the interface between the user
application and the network. A web browser and an email client are
examples of user applications. The user application itself does not reside at
the Application layer - the protocol does. The user interacts with the
application, which in turn interacts with the application protocol.
 Examples of Application layer protocols include: • FTP, via an FTP client •
HTTP, via a web browser • POP3 and SMTP, via an email client • Telnet The
Application layer provides a variety of functions: • Identifies
communication partners • Determines resource availability • Synchronizes
communication The Application layer interacts with the Presentation layer
below it. As it is the top-most layer, it does not interact with any layers
above it.
 OSI MODEL REFERENCE EXAMPLE

 OSI Reference Model Example A web browser serves as a good practical illustration of
the OSI model and the TCP/IP protocol suite:
 • Τhe web browser serves as the user interface for accessing a website. The browser itself
does not function at the Application layer. Instead, the web browser invokes the Hyper
Text Transfer Protocol (HTTP) to interface with the remote web server, which is why http://
precedes every web address.
 • The Internet can provide data in a wide variety of formats, a function of the
Presentation layer. Common formats on the Internet include HTML, XML, PHP, GIF, and
JPEG. Any encryption or compression mechanisms used on a website are also
considered a Presentation layer function.
 OSI MODEL REFERENCE EXAMPLE

 • The Session layer is responsible for establishing, maintaining, and terminating the session
between devices, and determining whether the communication is half-duplex or full-
duplex. However, the TCP/IP stack generally does not include session-layer protocols, and
is reliant on lower-layer protocols to perform these functions.
 • HTTP utilizes the TCP Transport layer protocol to ensure the reliable delivery of data. TCP
establishes and maintains a connection from the client to the web server, and packages
the higher-layer data into segments. A sequence number is assigned to each segment so
that data can be reassembled upon arrival.
 The best path to route the data between the client and the web server is determined by
IP, a Network layer protocol. IP is also responsible for the assigned logical addresses on
the client and server, and for encapsulating segments into packets
 OSI MODEL REFERENCE EXAMPLE

 Data cannot be sent directly to a logical address. As packets travel from network to
network, IP addresses are translated to hardware addresses, which are a function of the
Data-Link layer. The packets are encapsulated into frames to be placed onto the
physical medium.
 • The data is finally transferred onto the network medium at the Physical layer, in the form
of raw bits. Signaling and encoding mechanisms are defined at this layer, as is the
hardware that forms the physical connection between the client and the web server.
 NETWORK PROTOCOLS: TCP/IP

 TCP/IP (Transmission Control Protocol/Internet Protocol)

 TCP is considered a reliable, full-featured transport layer protocol, which ensures
that all of the data arrives at the destination. TCP includes fields which ensure the
delivery of the application data.
These fields require additional processing by the sending and receiving hosts.
• TCP provides reliability and flow control using these basic operations:
• Number and track data segments transmitted to a specific host from a specific
application • Acknowledge received data • Retransmit any unacknowledged
data after a certain amount of time • Sequence data that might arrive in wrong
order • Send data at an efficient rate that is acceptable by the receiver
 NETWORK PROTOCOLS: TCP/IP

 Example: When you load a webpage, TCP ensures that all parts of the page are
received and assembled correctly.

IP (Internet Protocol): Handles addressing and routing of data packets, ensuring

they are sent to the correct destination. IP also determines the best route for data
to travel across interconnected networks.

IPv4 and IPv6: IPv4 is the most common format (e.g., [Link]), while IPv6 is its
successor with a longer address format to handle more devices.
NETWORK PROTOCOLS: UDP

 • UDP is a simpler transport layer protocol than TCP. It does not provide
reliability and flow control, which means it requires fewer header fields.
Because the sender and the receiver UDP processes do not have to
manage reliability and flow control, this means UDP datagrams can be
processed faster than TCP segments.
 UDP provides the basic functions for delivering datagrams between the
appropriate applications, with very little overhead and data checking.•
UDP is a connectionless protocol.
 UDP does not provide reliability or flow control, it does not require an
established connection. Because UDP does not track information sent or
received between the client and server, UDP is also known as a stateless
protocol
NETWORK PROTOCOLS: DNS

 Domain Name Servers (DNS) • In data networks, devices are labeled with
numeric IP addresses to send and receive data over networks. Domain
names were created to convert the numeric address into a simple,
recognizable name.
 The DNS protocol defines an automated service that matches resource
names with the required numeric network address.
 The DNS protocol communications use a single format called a message.
This message format is used for all types of client queries and server
responses, error messages, and the transfer of resource record information
between servers.
NETWORK PROTOCOLS: DHCP

 Dynamic Host Configuration Protocol (DHCP) • On larger networks,

DHCP is preferred for address assignment. Rather than use static
addressing for each connection, it is more efficient to have IPv4
addresses assigned automatically using DHCP.
 DHCP can allocate IP addresses for a configurable period of time,
called a lease period. When the lease period expires or the DHCP
server gets a DHCPRELEASE message, the address is returned to the
DHCP pool for reuse.
 Users can freely move from location to location and easily re-establish
network connections through DHCP
 NETWORK PROTOCOLS: HTTP/HTTPS

 HTTP/HTTPS (Hypertext Transfer Protocol/Secure)

 HTTP is the protocol used for transferring web pages on the internet, while HTTPS adds
a layer of encryption for secure communication.
HTTP: Manages requests between a web client (browser) and a web server. It
enables the loading of web pages, images, and other resources.
Example: When you type a URL in your browser, it sends an HTTP request to the server,
which then returns the requested webpage.

HTTPS: Adds encryption (SSL/TLS) to ensure secure data transmission, protecting

sensitive information like passwords and credit card details from eavesdropping.
Example: Used when accessing online banking or shopping sites (indicated by the
padlock icon in the browser).
NETWORK PROTOCOLS: FTP

 FTP (File Transfer Protocol)

Purpose: Transfers files between computers on a network, typically

between a client and a server.

How it works: FTP uses two connections—one for commands and one for
data transfer. It can be used to upload or download files from a server.

Example: A web developer might use FTP to upload files to a web server
for publishing a website.
 NETWORK PROTOCOLS: NAT

 NAT (Network Address Translation)

Purpose: Allows multiple devices on a local network to share a single public IP

address when accessing the internet.

How it works: NAT translates private IP addresses (used within a local network) to
a single public IP address, allowing devices to communicate with external
networks.

Example: In a home network, all devices (laptops, phones, etc.) share a single
public IP address, thanks to NAT, but have unique private IPs within the home
network.
 NETWORK PROTOCOLS: TELNET/SSH

 Telnet and SSH (Secure Shell)

Purpose: Used for remote access to devices, typically for management purposes.

Telnet: Provides basic command-line access to devices over a network but is

insecure as it transmits data in plain text.
Example: Telnet can be used to log into a network device (e.g., a router) and
manage it, though it’s often replaced by SSH for security reasons.

SSH: Provides secure, encrypted remote access to network devices, offering a

safer alternative to Telnet.
Example: A network admin can use SSH to securely log into a remote server and
manage it using command-line instructions.
NETWORK PROTOCOLS: ICMP

 ICMP (Internet Control Message Protocol)

Purpose: Used by network devices to send error messages and

operational information, such as when a service is unreachable.

How it works: ICMP is often used in tools like ping to check the availability
of a device or the health of a network connection.

Example: When you "ping" a website to see if it's online, ICMP is used to
send and receive echo request and reply messages.
NETWORK SECURITY
INTRODUCTION

 Network security relates directly to an organization's business continuity.

Network security breaches can disrupt e-commerce, cause the loss of
business data, threaten people’s privacy, and compromise the integrity
of information. These breaches can result in lost revenue for
corporations, theft of intellectual property, lawsuits, and can even
threaten public safety.
 Network security professionals must protect the organization’s data.
Various Data Loss Prevention (DLP) controls must be implemented that
combine strategic, operational, and tactical measures.
 FIREWALL

 Firewalls are crucial components in network security, acting as barriers

between trusted internal networks and untrusted external networks. They
monitor and control incoming and outgoing network traffic based on
predetermined security rules

 Definition of a Firewall
A firewall is a security device or software that enforces a set of security rules to
control the flow of traffic between different networks, primarily to protect
networks from unauthorized access and threats.
 FIREWALL

 Purpose of Firewalls

Traffic Control: Firewalls determine which traffic can enter or leave a network
based on specific rules.

Threat Prevention: They help prevent unauthorized access and mitigate threats
such as malware, hacking attempts, and DDoS attacks.

Network Segmentation: Firewalls can segment networks into different zones,

providing more control over security policies.

Logging and Monitoring: Firewalls keep logs of traffic, which can be analyzed
for security incidents and compliance.
TYPES OF FIREWALL

 Packet filtering firewall

 Packet filtering firewalls operate inline at junction points where
devices such as routers and switches do their work. However,
these firewalls don't route packets; rather, they compare each
packet received to a set of established criteria, such as the
allowed IP addresses, packet type, port number and other
aspects of the packet protocol headers. Packets flagged as
troublesome are not forwarded and, thus, cease to exist.
 TYPES OF FIREWALL

 Packet filtering firewall advantages

 A single device can filter traffic for the entire network.
 Extremely fast and efficient in scanning traffic.
 Inexpensive.
 Minimal effect on other resources, network performance and end-user experience.
 Packet filtering firewall disadvantages
 Because traffic filtering is based entirely on IP address or port information, packet
filtering lacks broader context that informs other types of firewalls.
 Doesn't check the payload and can be easily spoofed.
 Not an ideal option for every network.
 Access control lists can be difficult to set up and manage.
 TYPES OF FIREWALL

 Proxy Firewalls

How it Works: Acts as an intermediary between a user’s device and the

internet. The firewall receives requests, performs filtering, and then forwards
them on behalf of the user.

Advantages: Provides anonymity, can cache data for faster access, and can
filter content.

Disadvantages: Can introduce latency; requires more resources for processing.

 TYPES OF FIREWALL

 Web Application Firewalls (WAF)

How it Works: Protects web applications by filtering and monitoring HTTP traffic
between a web application and the internet.

Advantages: Defends against specific attacks like SQL injection, cross-site

scripting (XSS), and other web-based threats.

Disadvantages: Limited to HTTP/HTTPS traffic; may require fine-tuning to

minimize false positives.
 TYPES OF FIREWALL

 Stateful Inspection Firewalls

How it Works: Tracks the state of active connections and makes decisions
based on the context of the traffic, allowing it to understand the connection
state (e.g., established, closing).

Advantages: More secure than packet-filtering; can keep track of ongoing

sessions.

Disadvantages: More resource-intensive than simple packet-filtering.

 TYPES OF FIREWALL

 Next-Generation Firewalls (NGFW)

How it Works: Combines traditional firewall capabilities with additional features

such as intrusion prevention systems (IPS), deep packet inspection, and
application awareness.

Advantages: Provides enhanced security by inspecting the content and

context of the traffic.

Disadvantages: More complex and costly; requires regular updates and

maintenance.
 TYPES OF FIREWALL

 Demilitarized Zone
 A demilitarized zone (DMZ) is a firewall design where there is typically one inside interface
connected to the private network, one outside interface connected to the public network,
and one DMZ interface, as shown in the figure.

 Traffic originating from the private network is inspected as it travels toward the public or DMZ
network. This traffic is permitted with little or no restriction. Inspected traffic returning from the
DMZ or public network to the private network is permitted.
 Traffic originating from the DMZ network and traveling to the private network is usually
blocked.
 TYPES OF FIREWALL

 Traffic originating from the DMZ network and traveling to the public network is selectively
permitted based on service requirements.
 Traffic originating from the public network and traveling toward the DMZ is selectively
permitted and inspected. This type of traffic is typically email, DNS, HTTP, or HTTPS traffic.
Return traffic from the DMZ to the public network is dynamically permitted.
 Traffic originating from the public network and traveling to the private network is blocked.
FIREWALL

 Private and Public

Traffic originating from the private network is permitted and inspected as it
travels toward the public network. Inspected traffic returning from the public
network and associated with traffic that originated from the private network is
permitted.
 Traffic originating from the public network and traveling to the private
network is generally blocked.
 FIREWALL

 Zone-Based Policy Firewalls

 Zone-based policy firewalls (ZPFs) use the concept of zones to provide additional flexibility. A
zone is a group of one or more interfaces that have similar functions or features. Zones help
you specify where a Cisco IOS firewall rule or policy should be applied. In the figure, security
policies for LAN 1 and LAN 2 are similar and can be grouped into a zone for firewall
configurations. By default, the traffic between interfaces in the same zone is not subject to
any policy and passes freely. However, all zone-to-zone traffic is blocked. In order to permit
traffic between zones, a policy allowing or inspecting traffic must be configured.
 The only exception to this default deny any policy is the router self zone. The self zone is the
router itself and includes all the router interface IP addresses. Policy configurations that
include the self zone would apply to traffic destined to and sourced from the router. By
default, there is no policy for this type of traffic. Traffic that should be considered when
designing a policy for the self zone includes management plane and control plane traffic,
such as SSH, SNMP, and routing protocols.
FIREWALL RULES AND POLICIES

 firewall policy is a set of rules and standards designed to control network

traffic between an organization’s internal network and the internet. It aims to
prevent unauthorized access, manage data movement, and guard against
potential security threats.
 Rule Creation: Firewalls use a set of rules to allow or deny traffic. Rules can be
based on various parameters, including IP addresses, protocols, ports, and
applications.

Default Policies: Firewalls usually have default policies (e.g., deny all traffic
unless explicitly allowed). Organizations should carefully configure their rules to
align with security requirements.
FIREWALL DEPLOYMENT MODELS

 Network-Based Firewalls: Installed at the network perimeter (e.g., between

the internal network and the internet). They protect the entire network.

Host-Based Firewalls: Installed on individual devices (e.g., servers,

workstations). They protect individual systems and can provide more
granular control.

Cloud Firewalls: Implemented in cloud environments to secure cloud-

based resources and applications. They can scale easily with cloud
infrastructure.
FIREWALL MAINTENANCE / MANAGEMENT

 Regular Updates: Firewalls require regular updates to rules and

software to adapt to new threats and vulnerabilities.

Monitoring and Logging: Continuous monitoring of firewall logs is

essential for detecting potential threats and understanding traffic
patterns.

Testing and Auditing: Regular testing (e.g., penetration testing) and

auditing of firewall rules and configurations help ensure that they
are effective and compliant with security policies.
BEST PRACTICES FOR FIREWALL
CONFIGURATION

 Clear Policies: Establish and document firewall rules based on business needs
and security requirements.

Limit Open Ports: Only keep the necessary ports open for services that need to
be accessible.

Implement Logging: Enable logging of all traffic for analysis and troubleshooting.

Conduct Regular Reviews: Periodically review and update firewall rules to ensure
they are still relevant and effective.

Use Multi-Layered Security: Combine firewalls with other security measures (e.g.,
IDS/IPS, antivirus software) for comprehensive protection.
INTRUSION DETECTION SYSTEM

 The IDS is a method that determines if there are any threats caused by
intrusions on the system throughout the observations of the network traffic. It is
available around the clock to generate information regarding the state of the
system, monitor the activities of the users, and provide reports to a
management station
 The purpose of IDS is to find different types of malware activities that are
dangerous for computers and devices. Such activities include: network
attacks against vulnerable services, attacks against privilege escalation,
unauthorized access to sensitive files as well as the actions of malware (viruses,
Trojans and worms)
 INTRUSION DETECTION SYSTEM

 Intrusion detection systems are classified into two general types known as signature based and
heuristic based.
 IDSs that operate on a single workstation are known as host intrusion detection system (HIDS),
while those that operate as stand-alone devices on a network are known as NIDS.
 HIDS monitor traffic on its host machine by utilizing the resources of its host to detect attacks.
NIDS operate as a stand-alone device that monitors traffic on the network to detect attacks.
 NIDS come in two general forms; signature based NIDS and heuristic based NIDS. These two
types of NIDS provide a varying degree
There are three different detection types for IDS:
 Misuse Detection,
 Anomaly Detection, and
 Hybrid detection:
INTRUSION DETECTION SYSTEM

 Misuse detection, also known as signature detection, searches for known

patterns of intrusion in the network or in the host. Each attack has a
specific signature, for instance, it can be the payload of the packet, the
source IP address, or a specific header. The IDS can raise an alarm if it
detects an attack that has one of the signatures listed in the list of known
signatures of the IDS. The advantage of this approach is its high accuracy
to detect known attacks. However, its weakness is that it is inefficient
against unknown or zero-day (never seen before attack) patterns.
 INTRUSION DETECTION SYSTEM

 Anomaly detection defines a normal state of the network or the host, called
a baseline, and any deviation from this baseline is reported as a potential
attack. For instance, anomaly-based IDS can create a baseline based on the
common network traffic such as the services provided by each host, the
services used by each host and the volume of activity during the day.
 Thus, if an attacker accesses an internal resource at midnight, and if in the
baseline there should be almost no activity at midnight, then the IDS will raise
an alarm.
 The advantage of anomaly detection is its flexibility to find unknown intrusion
attacks. However, in most cases it is difficult to precisely define what the
baseline of a network is, thus, the false detection rate of these techniques
can be high.
INTRUSION DETECTION SYSTEM


Hybrid detection combines both of the
aforementioned detections. Generally, they
have a lower false detection rate than anomaly
techniques and can discover new attacks.
INTRUSION PREVENTION SYSTEM

 Intrusion Prevention Systems (IPSs) have become widely

recognized as a powerful tool and an important element of IT
security safeguards. An IPS is any device that has the ability to
detect attacks, both known and unknown, and prevent the
attack from being successful. IPS technologies are differentiated
from IDS technologies by one characteristic. IPS technologies
can respond to a detected threat by attempting to prevent it
from succeeding. They use several response techniques, which
can be divided into the following groups.
INTRUSION PREVENTION SYSTEM

 Signature-Based IPS: It is commonly used by many IPS solutions. Signatures are added
to the devices that identify a pattern that the most common attacks present. That’s
why it is also known as pattern matching. These signatures can be added, tuned, and
updated to deal with the new attacks.
 Anomaly-Based IPS: It is also called as profile-based. It attempts to discover activity
that deviates from what an engineer defines as normal activity. Anomaly-based
approach can be statistical anomaly detection and non-statistical anomaly detection.
Policy-Based IPS: It is more concerned with enforcing the security policy of the
organization. Alarms are triggered if activities are detected that violate the security
policy coded by the organization. With this type approaches security policy is written
into the IPS device.
 Protocol-Analysis-Based IPS: Is similar to signature based approach. Most signatures
examine common settings, but the protocol analysis -based approach can do much
deeper packet inspection and is more flexible in finding some types of attacks [6].
NETWORK SEGMENTATION

 Network segmentation is the practice of dividing a computer network into

smaller, isolated segments or sub-networks, each of which can function
independently. This approach enhances security, performance, and
management within the network. Here are some key points about network
segmentation:

 Improved Security: By isolating sensitive data or critical systems in separate

segments, network segmentation reduces the risk of unauthorized access. If one
segment is compromised, the attacker's ability to move laterally across the network
is limited.

2. Enhanced Performance: Segmentation can reduce congestion by limiting

broadcast traffic to specific segments, improving overall network performance and
speed.

3. Simplified Management: Segmented networks can be easier to manage and

monitor. Network administrators can implement specific policies and controls for
each segment based on its requirements.
TYPES OF SEGMENTATION

 Physical Segmentation: Involves using separate

hardware devices, such as switches and routers, to
create distinct segments.

Logical Segmentation: Uses VLANs (Virtual Local Area

Networks) to create separate segments on the same
physical hardware. This is often more cost-effective than
physical segmentation.