Syngress - Eleventh Hour Network+ Exam N10-004 Study Guide (11 ...

122 CHAPTER 8 Security Standards and Services
■
■
IDSes may be software-based or may combine hardware and software.
Network IDS exists for the purpose of catching malicious activity once the
activity occurs anywhere within your network environment.
Intrusion Prevention Systems
An intrusion prevention system (IPS) is basically the same tool as an IDS except
that it has the capability to take some sort of action in response to a suspected
attack, such as blocking the malicious network traffic.
An IPS is capable of responding to attacks when they occur, such as:
■ Halting the attack in progress.
■ Automatically updating firewall and router rules to block future traffic from
the same address.
FIREWALLS
A firewall blocks access to an internal network from outside and blocks users of
the internal network from accessing potentially dangerous external networks or
ports. There are three distinct firewall technologies:
■ Packet filtering A network layer firewall or packet-filtering firewall works
at the network layer of the Open Systems Interconnection (OSI) model
and can be configured to deny or allow access to specific ports or Internet
Protocol (IP) addresses. It is designed to operate rapidly by either allowing
or denying packets simply based on source and destination IP address and
port information. This is the simplest and fastest form of traffic-filtering
firewall technologies.
■ It works in two directions: to keep intruders at bay and to restrict access
to the external network from internal users.
■ Two distinct firewall base policies are as follows:
• Allow by default – it allows all traffic to pass through the firewall except
traffic that is specifically denied.
• Deny by default – it blocks all traffic from passing through the firewall
except for traffic that is explicitly allowed.
■ Ports 0 through 1023 are considered well-known ports. These ports are
used for specific network services and should be considered the only ports
allowed to transmit traffic through a firewall.
■ Ports outside the range of 0 through 1023 are either registered ports or
dynamic/private ports.
• User ports range from 1024 to 49,151.
• Dynamic/private ports range from 49,152 to 65,535.
■ Since only the header of a packet is examined, a packet-filtering firewall
has speed.
■ There are two major drawbacks to packet filtering:
• A port is either open or closed.
• It does not understand the contents of any packet beyond the header.
■ Stateful inspection Stateful inspection operates at the network and the
transport layers of the OSI model, but it has the ability to monitor