urel,
- All Internet Control Message Protocol (ICMP) data should be denied
- Block telnet (terminal emulation) access to all internal servers from the public networks
- When Web services are offered outside the firewall, deny HTTP traffic from reaching your internal networks by using some form of proxy access or DMZ architecture.
Question 110. What Are Intrusion Detection Systems(ids)?
IDSs work like burglar alarms
IDSs require complex configurations to provide the level of detection and response desired
An IDS operates as either network-based, when the technology is focused on protecting network information assets, or host-based, when the technology is focused on protecting server or host information assets
IDSs use one of two detection methods, signature-based or statistical anomaly-based.
Question 111. What Are Different Types Of Idss?
- Network-based IDS
- Host-based IDS
- Application-based IDS
- Signature-based IDS
- Statistical Anomaly-Based IDS.
Question 112. Define Nids ?
A network-based IDS(NIDS) resides on a computer or an appliance connected to a segment of an organization’s network and monitors traffic on that network segment,looking for indications of ongoing or successful attacks.
Question 113. What Is Hids?
A Host-based IDS(HIDS) works differently from a network-based version of IDS. A host-based IDS resides on a particular computer or server,known as the host and monitors activity only on that system. HIDs are also known as System Integrity Verifiers as they benchmark and monitorthe status of key system files and detect when an intruder creates ,modifies or deletes monitored files.
Question 114. What Is The Use Of Hids?
A HIDs is also capable of monitoring system configuration databases,such as windows registries,in addition to stored configuration files like .ini,.cfg,and .dat files.
Question 115. What Is Application-based Ids?
A refinement of Host-based IDs is the application-based IDS(AppIDS). The application based IDs examines an application for abnormal incidents. It looks for anomalous occurrences such as users exceeding their authorization,invalid file executions etc.
Question 116. What Is Signature-based Ids?
A signature-based IDS(also called Knowledge-based IDs) examines data traffic in search of patterns that match known signatures – that is,preconfigured ,predetermined attack patterns.
Question 117. What Is Lfm?
Log File Monitor(LFM) is an approach to IDS that is similar to NIDS. Using LFm the system reviews the log files generated by servers,network devices,and wven other IDSs. These systems look for patterns and signatures in the log files that may indicate an attack or intrusion is in process or has already succeeded.
Question 118. What Are Honey Pots?
Honey pots are decoy systems designed to lure potential attackers away from critical systems and encourage attacks against the themselves. These systems are created for the sole purpose of deceiving potential attackers. In Industry they are known as decoys,lures,and fly-traps.
Question 119. What Are Honey Nets?
When a collection of honey pots connects several honey pot systems on a subnet,it may be called a honey net.
Question 120. What Are Padded Cell Systems?
A Padded Cell is a honey pot that has been protected so that it cannot be easily compromised. In otherwords,a padded cell is a hardened honey spot..
Question 121. What Are The Advantages And Disadvantages Of Using Honey Pot Or Padded Cell Approach?
- Attackers can be diverted to targets that they cannot damage.
- Administrators have time to decide how to respond to an attacker.
- Attackers action can be easily and extensively monitored
- Honey pots may be effective at catching insiders who are snooping around a network.
- The legal implication of using such devices are not well defined.
- Honey pots and Padded cells have not yet been shown to be generally useful security technologies.
- An exper attacker,once diverted into a decoy system,may become angry and launch a hostile attack againt an organization’s systems
- Admins and security managers will need a high level of expertise to use