2. Objectives
5.1 List and discuss the various types of
firewalls and the common approaches
to firewall implementation.
5.2 Define and describe the types of
intrusion detection and prevention
systems and the strategies on which
they are based
3. 3
Firewalls
In InfoSec, a firewall is any device that prevents a
specific type of information from moving between
the outside world, known as the untrusted network
(e.g., the Internet), and the inside world, known as
the trusted network
4. 4
Categories of Firewalls
The most common types of firewalls are:
Packet filtering firewalls
Application layer proxy firewalls
Stateful packet inspection firewalls
Unified Threat Management (UTM) devices
5. 5
Packet Filtering Firewalls
Packet filtering firewalls are simple networking devices that filter
packets by examining every incoming and outgoing packet
header
They can selectively filter packets based on values in the packet
header, accepting or rejecting packets as needed
These devices can be configured to filter based on IP address,
type of packet, port request, and/or other elements present in
the packet
7. 7
•Similar to UTM devices, next-generation firewalls
(NextGen or NGFW) combine traditional firewall
functions with other network security functions such as
deep packet inspection, IDPSs, and the ability to decrypt
encrypted traffic
•The functions are so similar to those of UTM devices that
the difference may lie only in the vendor’s description
Next-Generation (NextGen) Firewalls
8. 8
When evaluating a firewall, ask the following questions:
1. What type of firewall technology offers the right balance
between protection and cost for the needs of the organization?
2. What features are included in the base price? What features are
available at extra cost? Are all cost factors known?
3. How easy is it to set up and configure the firewall? How
accessible are the staff technicians who can competently
configure the firewall?
4. Can the candidate firewall adapt to the growing network in the
target organization?
Selecting the Right Firewall
10. 10
•IDPSs work like burglar alarms and combine tried-and-
true detection methods from intrusion detection systems
(IDSs) with the capability to react to changes in the
environment, which is available in intrusion prevention
technology
Intrusion Detection and Prevention Systems
11. 11
•Systems that include IPS technology attempt to
prevent the attack from succeeding by:
•Stopping the attack by terminating the network
connection or the attacker’s user session
Intrusion Detection and Prevention Systems
(Continued)
12. 12
Intrusion Detection and Prevention Systems
(Continued)
Figure 5-2: Intrusion Detection and Prevention Systems
13. 13
• A host-based IDPS works by configuring and classifying various
categories of systems and data files
• Unless the IDPS is very precisely configured, benign actions can generate
a large volume of false alarms
• Host-based IDPSs can monitor multiple computers simultaneously by
storing a client file on each monitored host and then making that host
report back to the master console, which is usually located on the
system administrator’s computer
Host-Based IDPS
14. 14
• Network-based IDPSs monitor network traffic and, when a predefined
condition occurs, notify the appropriate administrator
• The network-based IDPS looks for patterns of network traffic and must
match known and unknown attack strategies against their knowledge
base to determine whether an attack has occurred
Network-Based IDPS
15. 15
Summary
• A firewall in an InfoSec program is any device that prevents a specific type of
information from moving between the outside world (the untrusted network) and
the inside world (the trusted network)
• Types of firewalls include packet filtering firewalls, application layer proxy firewalls,
stateful packet inspection firewalls, and Unified Threat Management devices.
There are three common architectural implementations of firewalls: single bastion
hosts, screened-host firewalls, and screened-subnet firewalls.
• A host-based IDPS resides on a particular computer or server and monitors activity on that
system. A network-based IDPS monitors network traffic; when a predefined condition occurs,
it responds and notifies the appropriate administrator
