DAY 18:
Today, let's go deeply into security appliances.
FIREWALL
In computer networking, a firewall is designed to control or filter which communications are allowed in and which are allowed out of a device or network. A firewall can be installed on a single computer with the purpose of protecting that one computer (host-based firewall) or it can be a standalone network device that protects an entire network of computers and all of the host devices on that network (network-based firewall).
As computer and network attacks have become more sophisticated, new types of firewalls have been developed, which serve different purposes. Let me also tell about some type of firewalls we have. There are:
1. Network layer firewall: This filters communications based on source and destination IP addresses.
2. Transport layer firewall: Filters communications based on source and destination data ports, as well as connection states.
3. Application layer firewall: Filters communications based on an application, program or service.
4. Context aware layer firewall: Filters communications based on the user, device, role, application type and threat profile.
5. Proxy server: Filters web content requests like URLs, domain names and media types.
6. Reverse proxy server: It's placed in front of web servers. Reverse proxy servers protect, hide, offload and distribute access to web servers.
7. Network address translation (NAT) firewall: This firewall hides or masquerades the private addresses of network hosts.
8. Host-based firewall: Filters ports and system service calls on a single computer operating system.
Let's talking about another thing more interesting. It's called PORT SCANNING.
In networking, each application running on a device is assigned an identifier called a port number. This port number is used on both ends of the transmission so that the right data is passed to the correct application. Port scanning is a process of probing a computer, server or other network host for open ports. It can be used maliciously as a reconnaissance tool to identify the operating system and services running on a computer or host, or it can be used harmlessly by a network administrator to verify network security policies on the network.
Let me show you how to carry out a port scan on a computer on your local home network.
1. Download and launch a port scanning tool like Zenmap. Enter the IP address of your computer, choose a default scanning profile and press ‘scan.’
The scan will report any services that are running, such as web or email services, and their port numbers.
2. The scan will also report one of the following responses:
>‘Open’ or ‘Accepted’ means that the port or service running on the computer can be accessed by other network devices.
>‘Closed,’ ‘Denied’ or ‘Not Listening’ means that the port or service is not running on the computer and therefore cannot be exploited.
>‘Filtered,’ ‘Dropped’ or ‘Blocked’ means that access to the port or service is blocked by a firewall and therefore it cannot be exploited.
3. To execute a port scan from outside of your network, you will need to run it against your firewall or router’s public IP address.
Enter the query ‘what is my IP address?’ into a search engine such as Google to find out this information.
Go to the Nmap Online Port Scanner, enter your public IP address in the input box and press ‘Quick Nmap Scan.’ If the response is open for ports 21, 22, 25, 80, 443 or 3389 then most likely, port forwarding has been enabled on your router or firewall and you are running servers on your private network.
This is little talk about networking (Nmap) which is in Cybersecurity and you can be very good at it if you practice too.
That should be enough for today. You should read to understand and if you are confused anywhere, you're free to ask questions.
THANK YOU
DAY 17:
There is no single security appliance or piece of technology that will solve all the network security needs in an organization. You must consider what tools will be most effective as part of your security system.
Regardless, let me discuss with you about SECURITY APPLIANCES.
SECURITY APPLIANCES can be standalone devices like a router or software tools that are run on a network device. They fall into six general categories.
1. Routers: While routers are primarily used to interconnect various network segments together, they usually also provide basic traffic filtering capabilities. This information can help you define which computers from a given network segment can communicate with which network segments.
2. Firewalls: Firewalls can look deeper into the network traffic itself and identify malicious behavior that has to be blocked. Firewalls can have sophisticated security policies applied to the traffic that is passing through them.
3. Intrusion prevention systems: IPS systems use a set of traffic signatures that match and block malicious traffic and attacks.
4. Virtual private networks: VPN systems let remote employees use a secure encrypted tunnel from their mobile computer and securely connect back to the organization’s network. VPN systems can also securely interconnect branch offices with the central office network.
5. Antimalware or antivirus: These systems use signatures or behavioral analysis of applications to identify and block malicious code from being executed.
6. Other security devices: Other security devices include web and email security appliances, decryption devices, client access control servers and security management systems.
Alright, today's session would be quite brief but I am sure that I have wrote somethings that you could learn from. You should read to understand and be free to ask questions. I appreciate your encouragement on all of my post. As usual, always remember to-
USE YOUR COMMON SENSE