INFRASTRUCTURE SECURITY&
INCIDENT MANAGEMENT
BY : MOHNISH SINGH
NETWORK SECURITY DEVICE ROLES
FIREWALL
 A choke point of control and monitoring
 Interconnects networks with differing trust
 Imposes restrictions on network services
 only authorized traffic is allowed
 Auditing and controlling access
 can implement alarms for abnormal behaviour
 Itself immune to penetration
 Provides perimeter defence
STATEFULL FILTERING
ROUTERSAND SWITCHES
802.1x
Load balancer
Load balancer
 SLB
 Gets user to needed resource:
 Server must be available
 User’s “session” must not be broken
 If user must get to same resource over and over, the SLB device must ensure that happens (ie,
session persistence)
 In order to do work, SLB must:
 Know servers – IP/port, availability
 Understand details of some protocols (e.g., FTP, SIP, etc)
 Network AddressTranslation, NAT:
 Packets are re-written as they pass through SLB device.
Most predominant algoritms:
least connections: server with fewest number of flows gets the new flow request.
weighted least connections: associate a weight / strength for each server and
distribute load across server farm based on the weights of all servers in the farm.
round robin: round robin thru the servers in server farm.
weighted round robin: give each server ‘weight’ number of flows in a row; weight
is set just like it is in weighted least flows.
There are other algorithms that look at or try to predict server load in determining
the load of the real server.
The SLB device can make its load-balancing decisions based on several factors.
Some of these factors can be obtained from the packet headers (i.e., IP address,
port numbers, etc.).
Other factors are obtained by looking at the data beyond the network headers.
Examples:
HTTP Cookies
HTTP URLs
SSL Client certificate
The decisions can be based strictly on flow counts or they can be based on
knowledge of application.
For some protocols, like FTP, you have to have knowledge of protocol to correctly
load-balance (i.e., control and data connection must go to same physical server).
Web server gateway &WAF
Web application firewalls are designed to work on the OSI
layer 7 (the application layer).They are fully aware of
application layer protocols such as HTTP(S) and SOAP and can
analyze those requests in great detail. Compared to a layer 3/4
firewall, rules can be defined to allow/disallow certain HTTP
requests like POST, PUSH, OPTIONS, etc., set limits in file
transfer size or URL parameter argument length.WAF log files
contain as much information as those from a web server plus the
policy decisions of the filter rules (e.g. HTTP request blocked;
file transfer size limit reached, etc.). AWAF provides a wealth
of information for filtering and detection purposes and is thus a
good place for the detection of attacks.
If the HTTP traffic is SSL encrypted (HTTPS), the NIDS
might not decrypt the traffic;
high traffic load can make it difficult to analyze network traffic in real time;
NIDS are designed to work on theTCP/IP level (OSI layer3/4), and thus may not be
as effective on the HTTP layer;
Attackers might use IDS evasion techniques (HTTP,encoding, fragmenting, etc.)
which the IDS is not aware of.
Snort, the most powerful open source IDS, has over 800 rules
for detecting malicious webtraffic (over 400 for PHP alone).With the help of
preprocessorlike frag3 (IP defragmentation), stream4 (statefulinspection/stream r
eassembly) and http_inspect (normalize anddetect HTTP traffic and protocol ano
maly) snort tries to
assemble packets and avoid IDS evasion techniques.These hurdles
have to be overcome before anything can be detected.
WEB SECURITY GATEWAY
sees application layer traffic http request and response
Contents and tags involved inside the application cross site
scripting identified and stopped by web security gate way
Infrastructure security & Incident Management
Proxy server
According to cooperate policy internal web traffic is redirected through proxy
Mode of operation
 Transparent – both parties (local/remote) are unaware that the connection is being
proxied
 Zorp - application layer proxy is transparent
 Opaque – the local party must configure client software to use the proxy
 client software must be proxy-aware software
 Netscape proxy server is opaque
 With all of the things modern firewalls can do in the area of redirection you could
configure the firewall to redirect all http requests to a proxy
 no user configuration required (transparent)
Proxy server works on 4-7
Functions :
Monitors at application layer
url filtering
Content filtering
Limit access control on websites
Proxy rules denying urls &web site based on categorization
A reverse-proxy is a "backwards" proxy-cache server; it's a proxy server that, rather
than allowing internal users to access the Internet, lets Internet users indirectly
access certain internal servers.
The reverse-proxy server is used as an intermediary by Internet users who want to
access an internal website, by sending it requests indirectly.With a reverse-proxy,
the web server is protected from direct outside attacks, which increases the internal
network's strength.What's more, a reverse-proxy's cache function can lower the
workload if the server it is assigned to, and for this reason is sometimes called a
server accelerator.
Finally, with perfected algorithms, the reverse-proxy can distribute the workload by
redirecting requests to other, similar servers; this process is called load balancing.
PROXY DIAGRAM
SPAM filters
UTM security appliance eg. Websense email gateway
Functions:
 url inspection
 Content inspection
 Malware inspection
NIDS & NIPS
 IDS see attack paterns and set alarms act as warning system
 Uses 1 connection
 IPS has the ability to block & stop traffic
 Uses 2 connections
 NIDS & NIPS sees traffic for subnets
Types of IDS & IPS
 Behavior based
 Signature based
 Anomaly based
 Heuristic
Infrastructure security & Incident Management
Infrastructure security & Incident Management
PROTOCOLANALYZER
 SNIFFERTOOL EG. WIRESHARK PCAP
USEDTO DETECT:
 FRAGMENTATION
 FLOODING
 ANALYZING & IDENTIFYING PROTOCOLS INTHE
ENVIORNMENT
DLP
 DATA LOSS PREVENTION
 INTERNAL TRAFFIC CONTAINS CONFEDENTIAL
INFORMATION WHICH SHOULD NOT BE ALLOWED TO
TRANSMIT OUTSIDE OFTHE ORGANIZATION
 DLP CONFIGURED ON INSTANT MESSAGING
 USB PORTS DISABLED
SIEM
 The process of gathering and maintaining network, system,
and application log data is
 commonly referred to using several different definitions. It is
sometimes defined as
 Security Information and Event Management (SIEM),
Security Event Management
 (SEM), Security Information Management (SIM), systems
monitoring, and network
 monitoring
Actionable Information
First and foremost, for SIEM to be truly useful, only actionable data must be sent onward to
system and application administrators or security staff.To make SIEM alerts actionable it must
address the “Five W’s”, a basic investigative technique of determining when the event
occurred, who was involved, what happened, where did it take place, and why did it happen.
The “Five W’s” can be mapped directly to common variables in a security investigation.
•When –Time/Date stamp of the event(s) happening
•Who – Identifier of the requestor; typically an IP address and/or a username
•What – Description of the event (such as a GET or POST to a web server)
•Where – System or application that generated the event and where the request
originated from
•Why –The purpose of the action and typically is what is being investigated
DEVICE SPECIFIC LOG CAPTURE
SIEM SOLUTION RSA SA
Incident Response Life cycle
INCIDENT RESPONSE
Infrastructure security & Incident Management

More Related Content

DOC
Firewall
PPTX
PPTX
Types of attack
PDF
WT - Firewall & Proxy Server
PDF
3 palo alto ngfw architecture overview
PPTX
Firewall
PDF
FIREWALL
Firewall
Types of attack
WT - Firewall & Proxy Server
3 palo alto ngfw architecture overview
Firewall
FIREWALL

What's hot (20)

PPSX
Firewall & its Services
PPTX
Firewall and It's Types
PDF
Web application & proxy server
PPT
Firewals in Network Security NS10
DOCX
PPTX
Firewall
PPTX
Firewall & Proxy Server
PPTX
Firewalls
PDF
RAZORPOINT SECURITY GLOSSARY
PDF
Ch20 book
PDF
Firewall traversals
PPT
Firewall
PPTX
Cisco Stealtwatch
PDF
Firewall & types of Firewall
PDF
Meeting 4 : proxy
PPT
Firewalls
PPTX
Firewall and its purpose
PPTX
RubiX ID - SOA Security - Ingrid Cox
Firewall & its Services
Firewall and It's Types
Web application & proxy server
Firewals in Network Security NS10
Firewall
Firewall & Proxy Server
Firewalls
RAZORPOINT SECURITY GLOSSARY
Ch20 book
Firewall traversals
Firewall
Cisco Stealtwatch
Firewall & types of Firewall
Meeting 4 : proxy
Firewalls
Firewall and its purpose
RubiX ID - SOA Security - Ingrid Cox
Ad

Similar to Infrastructure security & Incident Management (20)

PPTX
Lec # 13 Firewall.pptx
PPTX
Firewall vpn proxy
PPTX
CN. Presentation for submitting project term pptx
PDF
00 Introduction for sangfor more important
PPTX
firewall as a security measure (1)-1.pptx
DOC
Firewall
PPTX
UNIT IV:Security Measurement Strategies
PPT
chapter 4.pptWOLAITA SODO UNIVERSITY SCHOOL OF INFORMATICS DEPARTMENT OF INFO...
PPT
Unit II Chapter 6 firewalls.ppt
PPT
Presentation, Firewalls
PDF
Cloud Computing Assignment 3
PDF
Protecting location privacy in sensor networks against a global eavesdropper
PDF
Protecting location privacy in sensor networks against a global eavesdropper
PPTX
Www architecture,cgi, client server security, protection
PPT
Firewall
PPT
Chapter_Five[1].ppt
PDF
Principles of Information Security 6th Edition Whitman Solutions Manual
PPT
Presentation, Firewalls
PPT
Day4
PDF
Principles of Information Security 6th Edition Whitman Solutions Manual
Lec # 13 Firewall.pptx
Firewall vpn proxy
CN. Presentation for submitting project term pptx
00 Introduction for sangfor more important
firewall as a security measure (1)-1.pptx
Firewall
UNIT IV:Security Measurement Strategies
chapter 4.pptWOLAITA SODO UNIVERSITY SCHOOL OF INFORMATICS DEPARTMENT OF INFO...
Unit II Chapter 6 firewalls.ppt
Presentation, Firewalls
Cloud Computing Assignment 3
Protecting location privacy in sensor networks against a global eavesdropper
Protecting location privacy in sensor networks against a global eavesdropper
Www architecture,cgi, client server security, protection
Firewall
Chapter_Five[1].ppt
Principles of Information Security 6th Edition Whitman Solutions Manual
Presentation, Firewalls
Day4
Principles of Information Security 6th Edition Whitman Solutions Manual
Ad

More from nullowaspmumbai (20)

PDF
ELK in Security Analytics
PPTX
Switch security
PPTX
Radio hacking - Part 1
PPTX
How I got my First CVE
PPTX
Power forensics
PPTX
Middleware hacking
PPTX
Internet censorship circumvention techniques
PPTX
How i got my first cve
PPTX
Adversarial machine learning updated
PPTX
PPTX
Adversarial machine learning
PPTX
Dll Hijacking
PPTX
Abusing Target
PDF
NTFS Forensics
PPTX
Drozer - An Android Application Security Tool
PPTX
Middleware hacking
PDF
Ganesh naik linux_kernel_internals
PDF
Buffer overflow null
PDF
Null Mumbai Meet_Android Reverse Engineering by Samrat Das
ELK in Security Analytics
Switch security
Radio hacking - Part 1
How I got my First CVE
Power forensics
Middleware hacking
Internet censorship circumvention techniques
How i got my first cve
Adversarial machine learning updated
Adversarial machine learning
Dll Hijacking
Abusing Target
NTFS Forensics
Drozer - An Android Application Security Tool
Middleware hacking
Ganesh naik linux_kernel_internals
Buffer overflow null
Null Mumbai Meet_Android Reverse Engineering by Samrat Das

Recently uploaded (20)

PDF
Hybrid horned lizard optimization algorithm-aquila optimizer for DC motor
PDF
A contest of sentiment analysis: k-nearest neighbor versus neural network
PDF
sustainability-14-14877-v2.pddhzftheheeeee
PDF
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
PDF
WOOl fibre morphology and structure.pdf for textiles
PPTX
Benefits of Physical activity for teenagers.pptx
PDF
NewMind AI Weekly Chronicles – August ’25 Week III
PDF
Assigned Numbers - 2025 - Bluetooth® Document
PDF
A comparative study of natural language inference in Swahili using monolingua...
PDF
Getting started with AI Agents and Multi-Agent Systems
PDF
CloudStack 4.21: First Look Webinar slides
PDF
Microsoft Solutions Partner Drive Digital Transformation with D365.pdf
PPTX
O2C Customer Invoices to Receipt V15A.pptx
PDF
A Late Bloomer's Guide to GenAI: Ethics, Bias, and Effective Prompting - Boha...
PDF
STKI Israel Market Study 2025 version august
PPTX
observCloud-Native Containerability and monitoring.pptx
PPTX
The various Industrial Revolutions .pptx
PDF
Zenith AI: Advanced Artificial Intelligence
DOCX
search engine optimization ppt fir known well about this
PDF
From MVP to Full-Scale Product A Startup’s Software Journey.pdf
Hybrid horned lizard optimization algorithm-aquila optimizer for DC motor
A contest of sentiment analysis: k-nearest neighbor versus neural network
sustainability-14-14877-v2.pddhzftheheeeee
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
WOOl fibre morphology and structure.pdf for textiles
Benefits of Physical activity for teenagers.pptx
NewMind AI Weekly Chronicles – August ’25 Week III
Assigned Numbers - 2025 - Bluetooth® Document
A comparative study of natural language inference in Swahili using monolingua...
Getting started with AI Agents and Multi-Agent Systems
CloudStack 4.21: First Look Webinar slides
Microsoft Solutions Partner Drive Digital Transformation with D365.pdf
O2C Customer Invoices to Receipt V15A.pptx
A Late Bloomer's Guide to GenAI: Ethics, Bias, and Effective Prompting - Boha...
STKI Israel Market Study 2025 version august
observCloud-Native Containerability and monitoring.pptx
The various Industrial Revolutions .pptx
Zenith AI: Advanced Artificial Intelligence
search engine optimization ppt fir known well about this
From MVP to Full-Scale Product A Startup’s Software Journey.pdf

Infrastructure security & Incident Management

  • 3. FIREWALL  A choke point of control and monitoring  Interconnects networks with differing trust  Imposes restrictions on network services  only authorized traffic is allowed  Auditing and controlling access  can implement alarms for abnormal behaviour  Itself immune to penetration  Provides perimeter defence
  • 8. Load balancer  SLB  Gets user to needed resource:  Server must be available  User’s “session” must not be broken  If user must get to same resource over and over, the SLB device must ensure that happens (ie, session persistence)  In order to do work, SLB must:  Know servers – IP/port, availability  Understand details of some protocols (e.g., FTP, SIP, etc)  Network AddressTranslation, NAT:  Packets are re-written as they pass through SLB device.
  • 9. Most predominant algoritms: least connections: server with fewest number of flows gets the new flow request. weighted least connections: associate a weight / strength for each server and distribute load across server farm based on the weights of all servers in the farm. round robin: round robin thru the servers in server farm. weighted round robin: give each server ‘weight’ number of flows in a row; weight is set just like it is in weighted least flows. There are other algorithms that look at or try to predict server load in determining the load of the real server. The SLB device can make its load-balancing decisions based on several factors. Some of these factors can be obtained from the packet headers (i.e., IP address, port numbers, etc.). Other factors are obtained by looking at the data beyond the network headers. Examples: HTTP Cookies HTTP URLs SSL Client certificate The decisions can be based strictly on flow counts or they can be based on knowledge of application. For some protocols, like FTP, you have to have knowledge of protocol to correctly load-balance (i.e., control and data connection must go to same physical server).
  • 10. Web server gateway &WAF Web application firewalls are designed to work on the OSI layer 7 (the application layer).They are fully aware of application layer protocols such as HTTP(S) and SOAP and can analyze those requests in great detail. Compared to a layer 3/4 firewall, rules can be defined to allow/disallow certain HTTP requests like POST, PUSH, OPTIONS, etc., set limits in file transfer size or URL parameter argument length.WAF log files contain as much information as those from a web server plus the policy decisions of the filter rules (e.g. HTTP request blocked; file transfer size limit reached, etc.). AWAF provides a wealth of information for filtering and detection purposes and is thus a good place for the detection of attacks.
  • 11. If the HTTP traffic is SSL encrypted (HTTPS), the NIDS might not decrypt the traffic; high traffic load can make it difficult to analyze network traffic in real time; NIDS are designed to work on theTCP/IP level (OSI layer3/4), and thus may not be as effective on the HTTP layer; Attackers might use IDS evasion techniques (HTTP,encoding, fragmenting, etc.) which the IDS is not aware of. Snort, the most powerful open source IDS, has over 800 rules for detecting malicious webtraffic (over 400 for PHP alone).With the help of preprocessorlike frag3 (IP defragmentation), stream4 (statefulinspection/stream r eassembly) and http_inspect (normalize anddetect HTTP traffic and protocol ano maly) snort tries to assemble packets and avoid IDS evasion techniques.These hurdles have to be overcome before anything can be detected.
  • 12. WEB SECURITY GATEWAY sees application layer traffic http request and response Contents and tags involved inside the application cross site scripting identified and stopped by web security gate way
  • 14. Proxy server According to cooperate policy internal web traffic is redirected through proxy Mode of operation  Transparent – both parties (local/remote) are unaware that the connection is being proxied  Zorp - application layer proxy is transparent  Opaque – the local party must configure client software to use the proxy  client software must be proxy-aware software  Netscape proxy server is opaque  With all of the things modern firewalls can do in the area of redirection you could configure the firewall to redirect all http requests to a proxy  no user configuration required (transparent)
  • 15. Proxy server works on 4-7 Functions : Monitors at application layer url filtering Content filtering Limit access control on websites Proxy rules denying urls &web site based on categorization A reverse-proxy is a "backwards" proxy-cache server; it's a proxy server that, rather than allowing internal users to access the Internet, lets Internet users indirectly access certain internal servers. The reverse-proxy server is used as an intermediary by Internet users who want to access an internal website, by sending it requests indirectly.With a reverse-proxy, the web server is protected from direct outside attacks, which increases the internal network's strength.What's more, a reverse-proxy's cache function can lower the workload if the server it is assigned to, and for this reason is sometimes called a server accelerator. Finally, with perfected algorithms, the reverse-proxy can distribute the workload by redirecting requests to other, similar servers; this process is called load balancing.
  • 17. SPAM filters UTM security appliance eg. Websense email gateway Functions:  url inspection  Content inspection  Malware inspection
  • 18. NIDS & NIPS  IDS see attack paterns and set alarms act as warning system  Uses 1 connection  IPS has the ability to block & stop traffic  Uses 2 connections  NIDS & NIPS sees traffic for subnets
  • 19. Types of IDS & IPS  Behavior based  Signature based  Anomaly based  Heuristic
  • 22. PROTOCOLANALYZER  SNIFFERTOOL EG. WIRESHARK PCAP USEDTO DETECT:  FRAGMENTATION  FLOODING  ANALYZING & IDENTIFYING PROTOCOLS INTHE ENVIORNMENT
  • 23. DLP  DATA LOSS PREVENTION  INTERNAL TRAFFIC CONTAINS CONFEDENTIAL INFORMATION WHICH SHOULD NOT BE ALLOWED TO TRANSMIT OUTSIDE OFTHE ORGANIZATION  DLP CONFIGURED ON INSTANT MESSAGING  USB PORTS DISABLED
  • 24. SIEM  The process of gathering and maintaining network, system, and application log data is  commonly referred to using several different definitions. It is sometimes defined as  Security Information and Event Management (SIEM), Security Event Management  (SEM), Security Information Management (SIM), systems monitoring, and network  monitoring
  • 25. Actionable Information First and foremost, for SIEM to be truly useful, only actionable data must be sent onward to system and application administrators or security staff.To make SIEM alerts actionable it must address the “Five W’s”, a basic investigative technique of determining when the event occurred, who was involved, what happened, where did it take place, and why did it happen. The “Five W’s” can be mapped directly to common variables in a security investigation. •When –Time/Date stamp of the event(s) happening •Who – Identifier of the requestor; typically an IP address and/or a username •What – Description of the event (such as a GET or POST to a web server) •Where – System or application that generated the event and where the request originated from •Why –The purpose of the action and typically is what is being investigated

Editor's Notes

  • #9: Scale applications / services Ease of administration / maintenance Easily and transparently remove physical servers from rotation in order to perform any type of maintenance on that server. Resource sharing Can run multiple instances of an application / service on a server; could be running on a different port for each instance; can load-balance to different port based on data analyzed.