MODULE-5
SYSTEM SECURITY &
EMERGING TRENDS
Intrusion Detection Systems (IDS)
• An Intrusion Detection System (IDS) is a security tool used to
monitor network traffic and system activities for malicious
actions or policy violations.
• Its main purpose is to detect attacks, suspicious behavior, or
unauthorized access within a network or computer system.
• An IDS continuously monitors and analyzes network or system
activities to detect suspicious behavior or attacks.
FIREWALL & ITS TYPES
•A firewall is a security device or software that monitors and
controls incoming and outgoing network traffic based on
predetermined security rules.
•It acts as a barrier between a trusted internal network and
untrusted external networks like the Internet.
•Firewalls can be hardware-based, software-based, or a
combination of both.
•Their primary function is to prevent unauthorized access,
detect malicious activity, and enforce security policies.
The following are the five types of firewalls:
[Link] filtering firewall.
[Link]-level gateway.
[Link]-level gateway(proxy firewall).
[Link] inspection firewall.
[Link]-generation firewall (NGFW).
FIREWALL ARCHITECTURE
FIREWALL ARCHITECTURE
• Firewall architecture refers to the placement and
configuration of firewalls, which act as barriers to control
network traffic based on security rules.
• Common architectural models include packet filtering
routers, screened host firewalls, dual-homed firewalls,
and screened subnet firewalls, each offering different levels
of security and flexibility.
•Packet filtering routers: Routers at the network edge are
configured with rules to accept or reject packets, providing a simple
and effective way to control traffic. These routers check basic
information about each packet, like the IP address and port number,
to decide whether to allow it or block it. They stay at the edge of the
network and give a quick, simple way to control traffic.
•Screened host firewalls: This architecture combines a packet-
filtering router with a separate firewall, like an application proxy
server, to screen packets before they reach the internal network and
perform deeper inspection. In this method, a packet-filtering router
works together with another firewall system, such as a proxy server.
The idea is that the router blocks unwanted traffic first, and then the
proxy or firewall does deeper checking before anything reaches the
internal network.
•Dual-homed firewalls: A dual-homed host has two network interfaces
and acts as a firewall, but is not directly connected to the internet. It can
provide a more secure architecture by not exposing the internal network
to the internet via the firewall. A dual-homed firewall is a computer with
two network interfaces. One connects to the internal network and the
other connects to the outside network. It acts as a firewall and ensures
that internal systems are not directly exposed to the internet, making the
setup more secure.
•Screened subnet firewalls: This model creates a "demilitarized zone"
(DMZ) between two firewalls. It places internet-facing services in the
DMZ to protect the internal network. This method creates a special
middle area between two firewalls called a DMZ (demilitarized zone).
Public services like web servers or email servers are placed in this DMZ.
If attackers reach those servers, they still cannot enter the internal
network because another firewall protects it.
Packet filtering
•How it works: Examines packet headers for
information like source/destination IP addresses, ports,
and protocols (e.g., TCP or UDP).
•Decision process: Compares this header information
against pre-configured rules to either allow or block the
packet.
•Limitations: This is a basic method and doesn't
inspect the actual content of the packet.
Stateful inspection
•How it works: A more advanced form of packet filtering that
tracks the state of active network connections.
•Decision process: Determines if a packet is part of an ongoing,
legitimate session. This adds a layer of security by blocking
packets that are not part of a known, authorized connection.
•Example: Allows return traffic for a connection that the internal
network initiated, while blocking uninvited incoming connections
Proxy filtering
•How it works: Acts as an intermediary, or "proxy," between a
user's device and the internet. The firewall creates a connection
to the remote server on the user's behalf.
•Decision process: The proxy server handles all traffic, allowing
it to inspect and filter based on specific applications or services.
•Example: Can filter web traffic based on content or prevent
certain applications from accessing the internet.
Content filtering and Deep Packet Inspection (DPI)
•How it works: Goes beyond header information to analyze
the actual data, or "payload," of the packet.
•Decision process: Can identify and block threats hidden
within the data, such as malicious code, malware, or specific
types of content.
•Application: Essential for next-generation firewalls (NGFWs)
to combat sophisticated threats that bypass basic filtering
methods.
Security Hardening Techniques
Zero Trust Architecture (ZTA)
Key Benefits
•Reduced Attack Surface:
Limits the entry points and scope for attackers.
•Prevents Lateral Movement:
Contains threats within a specific segment, preventing them from
moving freely across the network.
•Enhanced Security for Remote Work:
Provides secure access for remote users and BYOD (Bring Your
Own Device) policies.
•Protection in Modern Environments:
Provides security for distributed resources in cloud, on-premises,
and mobile environments where a traditional perimeter is no
longer effective.
Offensive applications of AI/ML in security
•Phishing and social engineering:
AI can be used to create highly convincing phishing
emails and campaigns, even for attackers with limited
skills.
•Vulnerability discovery:
Attackers can use AI to automate the process of finding
vulnerabilities in code and network infrastructure.
•Sophisticated attacks:
AI can help craft more refined attack prototypes to
bypass security programs