2-4-2 Network Security

Highlighted text? Practice this concept. Highlighted passages and figures open related questions.

Practice related questions (5)Progress & bookmarks

Current section

p. 391

Practice this section 5 linked exam questions with default filters

Progress

Not marked complete

2-4-2 Network Security

Network security is a general name for security against attacks using networks. Network access control to prevent intrusion (i.e., unauthorized access) into internal networks is important in network security.

(1) Firewall

Firewalls are mechanisms that are installed at the boundary between internal networks (e.g., LANs) and other networks in order to protect internal networks from unauthorized access. Two typical firewall techniques are as follows:

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: • Packet filtering This is a technique that permits or denies the passing of packets according to configuration rules of delivery information, such as the source IP address/port number and destination IP address/port number in the packets. Control is primarily based on information included in headers of IP, TCP, UDP, ICMP, and such other protocol, to restrict unnecessary communication from outside. • Application gateway This is a gateway that is deployed at the boundary of networks, and controls (i.e., permits or denies) communications between internal and external networks by means of a program (i.e., proxy program) that relays an application. Although a separate relay program must be prepared for each type of application, it can control application commands and data at a detailed level, and thereby can help achieve a high level of security. — p. 391 · Enlarge

Packet filtering by addresses and ports · 1 practice questions

A network segment isolated by a firewall from other internal LAN segments is called a DMZ (DeMilitarized Zone). If a server to be made publicly available is installed in a DMZ, unauthorized access from the outside can be blocked by a firewall. Moreover, even if the server is attacked, damage to internal segments can be prevented. However, if sufficient measures are not taken on mail servers and other servers, the servers may be used as stepping stones for spam e-mail.

p. 392

A reverse proxy also performs the same type of role as a firewall. A reverse proxy receives requests from a client in place of a specified server and relays the request to the specified server. Since this flow is reversed from that of a regular proxy server, which acts as a proxy to relay access from the inside to the outside, the server is called a reverse proxy. By embedding the functions to scan the content of packets and URLs during relay, access to a specified server can be blocked. (This function corresponds to an application gateway). However, a reverse proxy is often used for the purpose of reducing the load on servers by acting as a proxy to respond to requests coming from large numbers of clients, or for the purpose of speeding response by storing content in cache. · 1 question

(2) IDS (Intrusion Detection System)

IDS (Intrusion Detection System) refers to a system that detects intrusion into network-connected equipment and such others, and performs collection and analysis of logs. It detects patterns corresponding to registered intrusion patterns, or those differing from access patterns in normal operation. · 1 question

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: • Host-based IDS This is a host-based IDS that monitors the access status of specified servers or clients, and detects intrusion. • Network-based IDS This is a network-based IDS that monitors packets passing through a network, and detects intrusion. — p. 392 · Enlarge

An IPS (Intrusion Protection System) sometimes have an extended function of IDS that can prevent any unauthorized intrusion by blocking the connection of an unauthorized intrusion when detected

(3) Quarantine network

A quarantine network is a mechanism to confirm the security of PCs connected to an internal network. The PCs is temporarily connected to an independent network (the quarantine network) for check, and if they present a problem with the network, measures are taken. Quarantine networks are generally used together with authentication servers, to confirm security through the flow “authentication → quarantine → connection.” The mechanism is also used to ensure security under BYOD (Bring Your Own Device) whereby employees are allowed to use personally-owned information devices for work.

p. 393

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: • Authentication server This is a server that is dedicated to performing authentication processing. There are various types such as RADIUS (Remote Authentication Dial-In User Service) servers that unify the management of system-wide authentication. The use of the authentication server enables single sign-on that allows users to access multiple systems (i.e., services) by logging on just once (i.e., one-time authentication). — p. 393 · Enlarge

(4) Call back

Call back is a user verification technique used for connections to internal networks via public lines such as regular telephone lines. Under this method of user verification, during dial-up access to a RAS (Remote Access Service) server via a public line, the RAS server cuts the outgoing call, identifies the user from a caller telephone number (or caller ID) registered with the RAS server, and calls back. However, as only the telephone or other communication device of the caller can be identified, unauthorized use of such a device by a third party cannot be detected. For that reason, the method is often used in combination with another user verification method, such as verification by user ID and password.

(5) Wireless LAN security

Since a wireless LAN allows easy connection to the LAN as long as the user is within an area where electromagnetic waves used for the wireless LAN reach, security measures to prevent unauthorized connection are important.