In this lesson,
we will learn about threat protection.
Threat protection is the implementation
of security measures to detect, prevent
and respond to threats and attacks.
Threat protection concepts include anti-malware,
host-based firewalls,
host-based intrusion detection systems
and host-based intrusion prevention systems.
Anti-malware is designed to detect,
prevent and remove malicious software,
including viruses, worms and ransomware.
Next, a host-based firewall is installed
on an individual endpoint to control incoming
and outgoing network traffic
based on a preset access control list.
Finally, host-based intrusion detection
and intrusion prevention systems,
monitor and analyze system activities
for signs of malicious behavior or policy violations.
Let's learn more about anti-malware,
host-based firewalls, host-based intrusion detection systems
and host-based intrusion prevention systems.
First, we have anti-malware.
It is essential to have antivirus
and anti-malware protection installed on all hosts,
not only as a security measure,
but also because it provides valuable logging
of potential infection attempts
across your system and network.
Antivirus works by scanning files, programs
and system activities for known malware signatures,
blocking or removing threats to prevent infection.
Anti-malware works by scanning for threats like adware,
spyware, viruses, worms and other harmful programs
using a combination of signature detection,
behavior analysis and heuristics
to block or remove those malicious threats.
In the past, separate tools, like antivirus for viruses
and anti-spyware for spyware, were used individually.
But today, these features are often integrated
into a single anti-malware solution.
For example, Windows Defender combines antivirus
and anti-spyware protections into one platform,
called Microsoft Defender Antivirus.
Just like pure, signature-based antivirus platforms,
it is important to keep anti-malware software up to date
and to regularly scan systems looking for malware.
Given the significant role of email in spreading malware,
it's also important to configure email settings carefully.
For example, disabling automatic previews
can help prevent harmful images from loading
and reduce the risk of infection.
Next, spam filters, which are often built-in
to anti-malware solutions,
can be used to block malicious emails
before they ever reach users, enhancing overall security.
And finally, since emails are a common attack vector
for phishing attacks, training users to avoid clicking
on suspicious links in their email
will help reduce the chance of successful phishing attack.
Furthermore, many anti-malware solutions
offer browser extensions that warn users
about suspicious or malicious websites,
providing an extra layer of protection
for a user while browsing.
Configuring browsers based on the network security zone,
they will operate in, such as an internet or the internet
can further help manage and reduce risk levels.
Anti-malware software can also detect and block spyware,
including key loggers, which are designed
to capture sensitive keystrokes and information.
Second, we have host-based firewalls.
Unlike network-based firewalls,
host-based firewalls are software installed directly
on individual machines.
Most operating systems come
with a host-based firewall built in,
but it usually needs to be enabled
to provide any protection.
These firewalls, often called personal firewalls,
are designed to accept or drop packets
based on the application or port being used,
specifically targeting inbound traffic.
For example, Microsoft provides Windows Firewall,
which can block inbound traffic based on IP address
or port numbers.
Hackers often attempt to spoof their IP addresses
using private IP address ranges like 10.0.0.0,
172.16.0.0 and 192.168.0.0.
However, a properly configured personal firewall
can quickly block all three of these ranges,
preventing many attacks.
Some attacks also originate from addresses
in the loopback, multicast or experimental ranges.
To defend against these, you should block
the ranges 127.0.0.0, 224.0.0.0 and 240.0.0.0.
If you are using Linux or OS X operating systems,
host-based firewalls are also available.
Linux commonly uses IP chains and IP tables
with IP tables being the more current
and more powerful option accessible
through the command line in Linux Shell.
For OS X systems, you can use the firewall located
within the system preferences
through the graphical user interface.
Third, we have host-based intrusion detection systems,
or HIDS.
Unlike their network-based counterparts,
HIDS are installed directly on individual endpoints
like servers, desktops or laptops
where they serve as the system's eyes and ears
for detecting suspicious activities.
Host-based intrusion detection systems monitor
the system closely by analyzing log files,
system configurations and application behavior
to spot unauthorized changes or attacks.
For example, host-based intrusion detection systems
can detect unusual file modifications,
unexpected processes or unauthorized access attempts
that might indicate malware or an intruder is at work.
When these threats are identified,
host-based intrusion detection systems, or HIDS,
can generate alerts and log the details of the threat,
giving administrators critical insights to investigate
and respond quickly to potential security breaches.
By running directly on the host,
host-based intrusion detection systems provide
a deep level of visibility
into what's happening on the machine,
allowing for real-time detection of threats
that might slip past other security measures.
Fourth and finally,
we have host-based intrusion prevention systems, or HIPS.
While similar to host-based intrusion detection systems,
host-based intrusion prevention systems go a step further
by not only detecting and logging potential threats,
but by also actively blocking attacks
before they can continue to do harm.
Host-based intrusion prevention systems
monitor system activities in real time
and use signature-based detection,
looking for known attack patterns,
as well as anomaly-based detection,
which identifies unusual behaviors
that deviate from a system's normal activity.
For instance, if host-based intrusion prevention systems
detect a suspicious file trying to modify system settings
or a malicious process attempting to run,
they will immediately block the action
and alert the user of the machine.
Host-based intrusion prevention systems are often integrated
with a centralized management server or orchestrator
that collects log files and alerts
from all endpoints in the network,
providing a unified view of security events
all across the organization.
This setup allows security teams to quickly analyze
and respond to attacks, coordinate defenses
and continuously update protection measures
based on emerging threats.
So remember, threat protection involves implementing
various security measures to detect, prevent
and respond to attacks and malicious activities.
Key components of threat protection
include anti-malware, host-based firewalls,
host-based intrusion detection systems
and host-based intrusion prevention systems.
Anti-malware helps detect and block harmful software,
such as viruses and spyware.
Next, host-based firewalls control network traffic
to and from individual devices.
Next, host-based intrusion detection systems,
monitor system activities for suspicious behavior,
providing alerts and logs for further investigation.
In contrast, host-based intrusion prevention systems
take a more proactive approach by not only detecting
but also blocking threats before they can cause damage.