Security Fundamentals



Devices

Firewalls

A firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules.

Firewalls have been a first line of defense in network security for over 25 years. They establish a barrier between secured and controlled internal networks that can be trusted and untrusted outside networks, such as the Internet.

A firewall can be hardware, software, or both.

Types of Firewalls

  • Proxy firewall
  • Stateful inspection firewall
  • Unified threat management (UTM) firewall
  • Next-generation firewall (NGFW)
  • Threat-focused NGFW

Firewall Softwares

  • Windows Firewall
  • Systemd Firewalld
  • Iptables

Firewall Devices

  • Fortinet FortiGate
  • pfSense
  • Cisco ASA Firewall
  • Check Point NGFW
  • Cisco Firepower NGFW Firewall
  • Sophos XG
  • Palo Alto Networks NG Firewalls
  • Check Point CloudGuard Network Security

Intrusion Prevention Systems (IPS)

Security = visibility + control

It is IPS technology that provides an active ability to control our networks. Control is paramount to enforcement. Control makes it possible to enforce compliance with security policy

An Intrusion-prevention system is used to actively drop packets of data or disconnect connections that contain unauthorised data. Intrusion-prevention technology is also commonly an extension of intrusion detection technology (IDS).

Next we look at the Intrusion Prevention System (IPS) and the deployment strategies associated with this technology. IPS technologies in either software or hardware are relatively new. One could say that the idea has been around for a long time and might suggest that router access control lists or firewall rules might be considered a basic IPS. Neil Desai opened an article posted on the SecurityFocus web site with this statement, “You blended your IDS with my firewall! No, you blended your firewall with my IDS! Either way, when you combine the blocking capabilities of a firewall with the deep packet inspection of an IDS, you get the new kid on the block: intrusion prevention systems or IPS.”

Intrusion Detection Systems (IDS)

Intrusion Detection is the art of detecting inappropriate, incorrect, or anomalous activity.

Security = visibility + control

IDS technology provides the visibility and offers many other benefits directly related to monitoring our networks. These include the active visibility of what is happening on our networks as it takes place as well as the ability to store this information for analysis and reporting at a later date. Visibility is paramount to decision making. Visibility makes it possible to create a security policy based on quantifiable, realworld data

Host-based Intrusion Detection System (HIDS)

A host IDS needs to be deployed on each protected machine (server or workstation). It analyzes data local to that machine such as system log files, audit trails and file system changes, and sometimes processes and system calls. HIDS alerts the administrator in case a violation of the preset rules occurs. Host IDS might use pattern matching in the observed audit trails or generate a normal behavior profile and then compare current events with this profile.

IDS deployment

First we look at the traditional IDS deployment. Most companies that have IDS installed have placed these devices in the perimeter either between the border router and the firewall or they have placed the IDS outside of the border router.
The companies that have gone the extra mile to install an IDS outside of the firewall and border router have done this so that they might see the full breadth of attempted attacks against their organization. When deploying an IDS both outside perimeter devices and inside of perimeter devices a company can confirm weather or not a potential attack seen outside of the perimeter has successfully made it past border routers and firewalls inside.

The most important concept in the deployment of an IDS is that an IDS is a tool used to capture and provide visibility into a corporate network. For larger companies and companies that have an added need for full visibility into network traffic, a common deployment method is to install IDS devices at all primary network points to provide visibility internally as well as externally. This type of deployment provides data needed to track down potential internal threats as well as those being posed against the company from outside. Still today the greatest risk comes from insider threats. Disgruntled employees, curious employees, outsourced services, and the trends of greater volumes of contracted services provide a higher level of vulnerability from within the network. As a result, the importance of deploying a mechanism to monitor internal traffic is paramount. The key being stressed at this point is visibility.

One concern of IDS deployments is the performance factor. The IDS solutions offered today have come a long way in design and the use of high-performance components that help to ensure the greatest amount data capture. Even with the higher performance components and updated software, a known fact is that current IDS implementations have a tendency to drop packets due to the high throughput of today’s high bandwidth network devices. Performance is a key issue in both IDS and IPS deployments. Another concern with IDS deployments is encryption. Currently, most IDS solutions do not have the ability to decrypt packets inbound or outbound and this blinds security administrators as to what is coming into and going out of corporate networks. With the explosive growth of VPN and other encrypted data streams the need to have a solution like IPS at the perimeter is becoming more and more necessary



Preservatif USB

Les « préservatifs USB » sont de petits adaptateurs USB avec des ports d’entrée et de sortie. Ils permettent d’alimenter l’appareil mais bloquent l’échange de données, ils bloquent ainsi l’accès au Virus. Ils coûtent environ 10 dollars et sont petits et faciles à emporter partout.

Ces préservatifs sont tout à fait pratiques pour la protection des appareils à port USB. Chaque appareil, de nos jours, a un port USB. Ce dernier peut servir à recharger nos téléphones portables partout. La connexion du téléphone à un port USB d’un transport peut être dangereuse. Ces ports peuvent devenir des failles que les cybercriminels pourraient utiliser pour accéder aux données les plus sensibles des utilisateurs.

De ce fait, les préservatifs USB protègent contre les dangers de ce qu’on appelle le « juice jacking ». Il s’agit d’une cyberattaque qui consiste à installer un programme malveillant dans les ports de chargement des stations. Ceux-ci infectent les téléphones et autres appareils d’utilisateurs qui ne sont pas méfiants.

Avec une numérisation assez rapide, la cybercriminalité est une pratique qui devient de plus en plus fréquentes. Cependant, comme toutes autres solutions, le préservatif USB est un atout pour amoindrir cette pratique qui peut porter atteinte à l’intimité des utilisateurs d’appareils.
Eninam BAGNABANA     |         |     bagnadavid@outlook.fr     |