Art of Network Defense | The Beginner’s Guide

Network Defense Banner | ybervie

In this article, we are going to discuss some methods that are used in Network Defense. The Security Actions we will focus on in this article are NIDS, NIPS, Firewalls, NAC, etc. Since this is a beginner’s guide we are only focusing on important things and tools and How they Works.

Network Intrusion Detection System (NIDS)

“Network intrusion detection systems (NIDS) are placed at a strategic point or points within the network to monitor traffic to and from all devices on the network. It performs an analysis of passing traffic on the entire subnet and matches the traffic that is passed on the subnets to the library of known attacks. Once an attack is identified, or abnormal behavior is sensed, the alert can be sent to the administrator.” — Wikipedia.

Basically, NIDS can be of any type of software or physical device. It is used to tap monitor the network and if any anomaly is found in the network it generates an alert for the human analyst to for analyzing.

Some Open-Source And Free NIDS

  1. Snort – Snort is one o f the best intrusion detection system and is completely free to use. You can check the official Website – https://www.snort.org/
  2. Suricata – Suricata is the leading independent open source threat detection engine. By combining intrusion detection (IDS), intrusion prevention (IPS), network security monitoring (NSM) and PCAP processing, Suricata can quickly identify, stop, and assess the most sophisticated attacks. https://suricata.io/
  3. Zeek – Zeek has a long history in the open source and digital security worlds. Vern Paxson began developing the project in the 1990s under the name “Bro” https://zeek.org/

All of the above are open-source and free to use. one can easily install and implement for practical learning.

Network Intrusion Prevention System

Network Intrusion Prevention System or NIPS is exactly the same as NIDS but can take defensive actions against the alerts. Where NIDS can only generate alerts to be analyzed, NIPS can actually take some defensive action and alter the network as per requirement.

Some of the Defensive Actions taken by NIPS are –

  1. Dropping the Malicious Packets.
  2. Resetting the Connection.
  3. Blocking the traffic from the malicious IP.
  4. NIPS Also can mitigate TCP sequencing issues and clean up unwanted transport and network layer options.
  5. many more…..

For trying out things you can refer to the list of software that is listed in the NIDS section.

Firewalls

“In computing, a firewall is a network security system that monitors and controls the incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted network and an untrusted network, such as the Internet.” –Wikipedia

Basically, Firewalls are used to separate the networks into different zones or private zones by taking the control of the traffics.

Types of Firewalls

1. Packet Filtering Firewalls

The most common type of firewall is the packet filtering firewall. It checks the traffics and examines the packets and prohibits them to pass if they do not follow the Security Rules. The Firewalls check the Source and Destination IP of the packet and let them pass if they are allowed according to the ruleset.

2. Next Generations Firewalls

NGFW’s are advanced firewalls. These firewalls are combinations of the classic firewall with some advanced features like- Encrypted Packet Analyzing, Inbuilt Intrusion Prevention System, Antivirus, and more. These Firewalls have also consisted of Deep Packet Inspection (DPI). DPI is one of the advanced features to check the header of each packet to identify or stop the malicious packets.

3. Web Application Firewall

“A web application firewall (WAF) is a specific form of application firewall that filters, monitors, and blocks HTTP traffic to and from a web service. By inspecting HTTP traffic, it can prevent attacks exploiting a web application’s known vulnerabilities, such as SQL injectioncross-site scripting (XSS), file inclusion, and improper system configuration.” –Wikipedia

The WAF works at the application layer and prevents any HTTP/s traffic that looks malicious or tries to load or get unauthorized data.

These are the main and important types of Firewalls. There are other types of firewalls like NAT Firewalls and SMLI Firewalls that are not mentioned here.

Logs Monitoring

All the Networks devices generate logs and if there is SIEM configured in the system all the logs will go to the SIEM Dashboard and there an analyst can examine all the logs.

Basically, log monitoring is one of the important steps in network defense, Because logs stores many important and crucial information about the network. A Security Analyst can easily identify which of the Requests or packets tends to show some vulnerabilities in the network and take action on it.

Analyzing Logs can be very helpful to determine whether any IP or Packet or request is an Indicator of compromise (IOC) or not.

Tools

Any SIEM software is able to monitor the logs. But there are some Open-Source tools we would Like to mention here that are built for log monitoring.

  1. Graylog 2 – Graylog is a leading open-source and robust centralized logging management tool.Official Site
  2. Logcheck – Logcheck is yet another open-source log monitoring tool that is run as a cron job. Official Site
  3. Logstash – Logstash is a free and open server-side data processing pipeline. Official Site

Network Access Control (NAC)

Network Access Control (NAC) is an approach to computer security that attempts to unify endpoint security technology (such as antivirus, host intrusion prevention, and vulnerability assessment), the user or system authentication, and network security enforcement.” –Wikipedia

Basically, Network Access Control or NAC ensures that unauthorized users and devices stay out of the private network.

Conslusion

Now we have learned about some important network defense methods and how they work. Each of the network defense methods listed above is a whole topic with lots of things that are not listed here. We recommend the readers to study each one of them in-depth to get a better understanding of the things.

For more blogs like this please visit our blog page.

For Network security Interview Question Visit Here.

About Cybervie

Cybervie provides best cyber security training program in hyderabad, India.This cyber security course enables you to detect vulnerablities of a system, wardoff attacks and manage emergency situations. Taking a proactive approach to security that can help organisations to protect their data, Cybervie has designed its training module based on the cyber security industry requirements with three levels of training in both offensive and defensive manner, and use real time scenarios which can help our students to understand the market up-to its standard certification which is an add on advantage for our students to stand out of competition in an cyber security interview.

More Info – Click Here

Share on facebook
Share on twitter
Share on linkedin
Share on whatsapp

Recent Posts

Follow Us on Youtube

Cyber Security Training Program 2020

Cyber security Course offered by Cybervie prepares students for a path of success in a highly demanding and rapidly growing field of cyber security. The course is completely designed with an adaptable mindset, where the program allows the student to complete the course work at their own pace while being able to complete weekly assignments. Hence, also making it convenient for busy working professionals to pursue the training to help them advance their career in cyber security.

Cybervie has designed the training module based on the cyber security industry requirements in both offensive and defensive manner, using real time scenarios which help our students to understand the market standards.

Sign up for our Newsletter

Interested in Cyber Security Training Program 2020 – Click Here