In this lesson,
we will learn about security devices.
Security devices are hardware
or software tools designed to protect networks and data
by enforcing policies
while monitoring for malicious activity.
Security devices include firewalls,
intrusion detection systems or IDS,
intrusion prevention systems or IPS,
virtual private networks or VPNs,
and network access control or NAC systems.
Let's explore each of these tools in more detail.
First, we have firewalls.
Firewalls utilize access control lists or ACLs to manage
and filter traffic based on rules.
While routers can implement basic ACLs directly,
hardware and software-based firewalls
are much more effective at managing access control lists
to permit or block traffic.
Access control lists define the type of traffic,
its source, destination,
and the action of firewall should take.
Firewall types include packet-filtering firewalls,
stateful firewalls, proxy firewalls,
next generation firewalls, and web application firewalls.
Packet filtering firewalls
are the most basic type of firewall.
They inspect only the header of the packet,
identifying IP addresses and port numbers
to determine whether to allow or deny traffic.
While efficient and quick,
packet filtering firewalls
can't prevent more advanced attacks like IP spoofing
or session hijacking
since they don't look beyond the packet header.
Stateful firewalls, on the other hand,
track the state of active connections.
They monitor outgoing requests
and only allow corresponding incoming traffic,
making them more secure.
For instance, if you request a webpage,
a stateful firewall will allow the return traffic
from that page,
but block unsolicited traffic.
In this way, stateful firewalls ensure
that only expected responses enter the network
while rejecting potential threats.
Proxy firewalls act as intermediaries
between internal and external connections,
making requests on behalf of a user.
There are two common types of proxy firewalls:
circuit-level proxies, which operate at the session layer,
and application-level proxies,
which inspect traffic at the application layer.
This deeper application layer inspection
allows application level proxies
to filter traffic more precisely,
though they come with a performance cost
due to their in-depth analysis.
Kernel proxy firewalls are a third type of proxy,
which are not used as frequently as circuit-level
and application-level firewalls.
Kernel proxy firewalls enhance performance
by filtering traffic across multiple OSI model layers
with minimal delay,
providing a balance between security and efficiency.
Next generation firewalls takes security
to the next level by being application aware.
This means they do not only inspect traffic,
but can differentiate between types of traffic,
providing greater control
and blocking specific application-based threats.
Next generation firewalls
can work with intrusion prevention systems
and conduct deep packet inspection
while maintaining high throughput.
Our last type of firewall is a web application firewall.
Web application firewalls specifically target web traffic
protecting against common attacks like SQL injection
and cross-site scripting.
They inspect HTTP traffic
and can be placed in line or out of band,
depending upon whether the goal is to actively block threats
or detect them without interfering with live traffic.
Our second set of security devices
are the intrusion detection systems or IDSs
and intrusion prevention systems or IPSs.
Both IDS and IPS monitor traffic for suspicious activity,
but their key difference lies
in how they respond to intrusions.
IDSs detect, log, and alert on malicious activity,
but they do not take action to stop that malicious activity.
IPSs, on the other hand, not only detect threats,
but they also react by blocking
or preventing the threat from continuing its activities.
Where an IDS is placed in the network
affects what it is called and how it's configured.
For example, a network IDS monitors traffic
through a mirrored port,
analyzing data for threats like network port scans
or malicious payloads.
As an IDS, it only alerts and records activity.
A host-based IDS or HIDS
runs on individual servers or endpoints,
detecting suspicious traffic or file access
on the specific system it's installed on only.
Similarly, a wireless IDS
or WIDS focuses on wireless network threats,
such as denial-of-service attacks
or deauthentication attempts.
IDS systems, in general,
typically use signature-based detection,
which recognizes known attack patterns
or anomaly-based detection.
Signature-based detection is highly accurate,
but limited to known threats.
Anomaly-based detection can catch new threats
based on anomalous behavior,
but may result in false positives.
As discussed, IPS systems detect, log,
and alert on malicious activity just like an IDS,
but they also have the ability to block threats.
A network IPS,
which is placed directly in line with traffic,
usually near the networks perimeter,
can stop attacks in real time.
Host-based and wireless IPSs work similarly,
responding to suspicious activity
by blocking threats like unauthorized application changes
or wireless attacks.
Our third security device type
is a virtual private network or VPN.
A VPN allows users to create an encrypted tunnel
over an untrusted network, like the internet,
to securely connect to enterprise networks.
Security can be enhanced
not only with a username and password,
but also with additional authentication factors.
The VPN tunnel itself uses strong encryption technologies
such as the advanced encryption standard or AES
with a 256-bit encryption key.
This encryption forms a virtual and secure circuit
between the user's device
and the VPN concentrator receiving the connection,
making it ideal for remote workers
or traveling employees who need access to company resources
like file servers from remote locations.
This setup is called a remote access VPN
or client-to-site VPN.
VPNs can also connect to office locations.
These are known as site-to-site VPNs,
and they offer a more cost-effective solution
than purchasing dedicated leased lines between office sites.
For example, if a company has a satellite office
in Washington D.C.
and wants to connect it
to its headquarters in San Francisco,
they can implement a site-to-site VPN.
In this setup, routers on both ends use encryption keys
to keep all data secured
as it travels across the untrusted internet.
Our fourth and last security device type
are the network access control or NAC systems.
NAC protects networks from unauthorized or unknown devices.
NAC is used to prevent unauthorized users
or devices from accessing a private network.
So when a device attempts to connect to the network,
the NAC system scans the device
to ensure it meets security requirements,
such as having updated antivirus software
and proper security patches.
This applies to both devices physically on the network
and those connecting remotely via a VPN.
If the device passes this health verification,
it is granted full access.
If it fails, it's likely quarantined into a remediation area
where it can receive updates,
but not access the production network
until it meets the required health standards.
Many organizations combined VPNs
with network access control solutions,
allowing the VPN connection
to check the compliance of a remote device
before granting full access to the network.
NAC solutions come in three types:
persistent, non-persistent, and agentless.
Persistent agents are installed directly on devices,
making them ideal for corporate environments
where the company controls the hardware.
Non-persistent agents,
common in places like college campuses,
are temporarily installed and scan devices upon connection.
Non-persistent agents delete themselves
when the scanning is complete.
Agentless solutions don't require software installation
on individual devices,
instead, they run from a domain controller,
making them ideal for environments
where devices aren't company-owned.
While agent-based solutions provide deeper scans,
agentless systems are continually improving
and are commonly used in bring your own device
or BYOD scenarios.
So remember, security devices are tools
that protect networks and data by enforcing policies
and monitoring for malicious activity.
Key security devices include firewalls,
intrusion detection systems, intrusion prevention systems,
virtual private networks,
and network access control systems.
Furthermore, firewalls use access control lists
to filter traffic.
IDSs or intrusion detection systems detect threats
without blocking them,
while IPS or intrusion prevention systems
take positive action to mitigate those threats.
Virtual private networks
or VPNs create secure encrypted tunnels
for remote connections,
making them ideal for accessing company resources securely
over the internet.
And finally, network access control or NAC solutions
ensure only authorized
and compliant devices can access the network,
scanning devices before allowing network access.