Syngress - Eleventh Hour Network+ Exam N10-004 Study Guide (11 ...

CHAPTER 8
Security Standards and
Services
121
Exam objectives in this chapter
■ Hardware and Software Security Devices
■ Security Zones
■ Network Ports, Services, and Threats
■ Network Access Security
HARDWARE AND SOFTWARE SECURITY DEVICES
Many tools that exist today will allow you to monitor, detect, and contain malicious
activity in your environment. Each of these tools assists you in being
well armed and well prepared to handle any malicious attacks that might come
your way.
Intrusion Detection Systems
An intrusion detection system (IDS) is a specialized tool that attempts to determine
when malicious activity is occurring within the network. It can make this
determination using a variety of different methods and features:
Some IDSes read and interpret the contents of log files from sensors placed
on the network, routers, firewalls, servers, and other network devices, and
attempt to match patterns in the log files.
Some IDSes monitor all the traffic traversing a network segment and use
signatures to match the traffic to known attack patterns.
Some IDSes are run on a network with a known good baseline of traffic.
Once they learn the “safe” traffic patterns, it attempts to determine when
abnormal activity is occurring which might be an indication of an attack.
Any of these IDS types could issue alarms or alerts and take various kinds
of automatic action in response to suspected attacks.
An IDS is designed and used to detect, attacks or unauthorized use of
systems, networks, and related resources.
■
■
■
■
■