eksinads

More about firewall, they also mention something about IPS/IDS. Which I had no idea what they were all about. Here’s the cheat sheet from Wikipedia.org.

Intrusion Prevention System (IPS)

An Intrusion prevention system (IPS) is a network security device that monitors network and/or system activities for malicious or unwanted behavior and can react, in real-time, to block or prevent those activities. Network-based IPS, for example, may operate in-line to monitor all network traffic for malicious code or attacks . When an attack is detected, it can drop the offending packets while still allowing all other traffic to pass. Intrusion prevention technology is considered by some to be an extension of intrusion detection (IDS) technology .

Intrusion prevention systems evolved in the late 1990s to resolve ambiguities in passive network monitoring by placing detection systems in-line. Early IPS were IDS that were able to implement prevention commands to firewalls and access control changes to routers. This technique fell short operationally for it created a race condition between the IDS and the exploit as it passed through the control mechanism. Inline IPS can be seen as an improvement upon firewall technologies, IPS can make access control decisions based on application content, rather than IP address or ports as traditional firewalls had done. However, in order to improve performance and accuracy of classification mapping, most IPS use destination port in their signature format. As intrusion prevention systems were originally a literal extension of intrusion detection systems, they continue to be related.

Intrusion prevention systems may also serve secondarily at the host level to deny potentially malicious activity. There are advantages and disadvantages to host-based IPS compared with network-based IPS. In many cases, the technologies are thought to be complementary.

An Intrusion Prevention system must also be a very good Intrusion Detection system to enable a low rate of false positives. Some IPS systems can also prevent yet to be discovered attacks, such as those caused by a buffer overflow.

more at Wikipedia.org.

Intrusion Detection System (IDS)

An IDS is a device (or application) that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station. Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents, which are violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices.^[1] Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents.^[1] Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators.^[1] In addition, organizations use IDPSs for other purposes, such as identifying problems with security policies, documenting existing threats, and deterring individuals from violating security policies.^[1] IDPSs have become a necessary addition to the security infrastructure of nearly every organization.^[1]

IDPSs typically record information related to observed events, notify security administrators of important observed events, and produce reports.^[1] Many IDPSs can also respond to a detected threat by attempting to prevent it from succeeding.^[1] They use several response techniques, which involve the IDPS stopping the attack itself, changing the security environment (e.g., reconfiguring a firewall), or changing the attack’s content.^[1]

More at Wikipedia.org.

We’re currently selecting several vendor to provide us with network firewall and I’m not an expert on it. Fortunately my friend brought a cheat sheet and I decided to post something here as a reminder. This article is quite brief but it gave me the big picture so that I could easily understand.

Host-based vs. Network Firewalls

Host-based firewalls (sometimes called “personal” firewalls) are simple, low cost programs or devices intended to protect a single computer. Examples include ZoneAlarm, Norton Personal Firewall, and the Internet Connection Firewall (ICF) built into Windows XP.

Network firewalls can protect multiple computers. However, not all network firewalls are created equal. Some are simple devices or programs that cost little more than personal firewalls. Many consumer-grade DSL and cable routers include this type of firewall technology. Simple network firewalls perform packet filtering, but usually don’t do more than very rudimentary ALF.

Enterprise firewalls are “all business,” designed for large, complex networks. It goes without saying that they cost much more. They will handle many more users, have faster throughput, and have advanced features, such as:

• Incorporation of VPN gateways
• Ability to manage multiple firewalls centrally
• Sophisticated monitoring and reporting mechanisms
• Can be extended through add-on modules or plug-ins
• Ability to control access via policies and apply different policies to different users
• More sophisticated authentication mechanisms
• High availability with load balancing and failover

Cost for host-based firewalls is usually around $100 or less. Enterprise firewalls can cost over $25,000. The most popular medium-range business firewalls cost from $1500 to around $5000. But that’s just the initial purchase price. As we’ll see later, many vendors charge extra for functionalities that others include free.

Hardware vs. Software Firewalls

All firewalls run firewall software, and they all run it on some sort of hardware, but the terms hardware firewall andsoftware firewall are used to distinguish between products marketed as an integrated appliance that comes with the software preinstalled, usually on a proprietary operating system, and firewall programs that can be installed on general purpose network operating systems such as Windows or UNIX.

Hardware firewalls can be further divided into those that are basically dedicated PCs with hard disks and those that are solid state devices built on ASIC (Application Specific Integrated Circuit) architecture. ASIC firewalls are generally faster performers and don’t have the hard disk (a mechanical device) as a potential point of failure.

Read the rest of this entry »