QUICK DISCUSSION & RESPONSE ACTIVITY

QUICKDISCUSSION & RESPONSE ACTIVITY

Directions: (PART 1)(PROVIDE SOURCES AT END, ONLY 1-2 SOURCES IS NEEDED)

What are the network securityrisks, and network security defense tools to reduce the risks? Please explainit in two-three paragraphs with valid references.

Directions: (PART 2)(There are 2 responses to respond back to)

Respond to these separateresponses with 2-3 sentences each response.

1^st Response: Asnetwork security dangers continue to escalate, it has never been more importantfor you to protect your company from cyber-attacks. Whether your company’s dataand information are kept on a hard drive or communicated over e-mail, beingaware of network security threats, learning how to avoid them, and engaging amanaged IT security provider can all help you avoid data breaches.

Here are some three most commoncategories network security risks that users need to be vigilant about:

The term “network reconnaissance”refers to the process of scanning a computer network for potentialvulnerabilities. This could be a reasonable attempt by the networkowner/operator to defend the network or enforce the acceptable use policy. Itcould potentially be a forerunner to external network attacks. When performedinside the network’s limits, several seeming reconnaissance operations thatwould be highly suspect if performed from outside the network may be completelyroutine network performance and reliability monitoring. Port scanning is one ofthe most frequent reconnaissance techniques, which involves sending data toseveral TCP and UDP (user datagram protocol) ports on a device and evaluatingthe response. Penetration testing can be used by businesses to see what their networkwould reveal in the event of a reconnaissance assault. Organizations can useport scanning tools (which scan vast networks to see whether hosts are up) andvulnerability scanners during testing (which find known vulnerabilities in thenetwork). Blocking ICMP echo queries from outside your network is critical andprevents attackers from gathering information using the ping and traceroutecapabilities. Attackers can employ a variety of tactics to launch eavesdroppingattacks, which often entail the use of a variety of eavesdropping equipment tolisten in on conversations and monitor network activity. For example, a hiddenbug physically installed in a home or business is a common example of anelectronic listening device. This might happen if a bug is left under a chairor on a table, or if a microphone is hidden inside an inconspicuous object likea pen or a bag. This is a straightforward strategy, but it could lead to theinstallation of more sophisticated, difficult-to-detect devices, such as microphonesembedded in lamps or ceiling lights, books on a bookshelf, or picture frames onthe wall. A denial-of-service (DoS) attack happens when a hostile cyber threatactor prevents legitimate users from accessing information systems, devices, orother network resources. Email, websites, online accounts (e.g., banking), andother services that rely on the compromised machine or network may bedisrupted. A denial-of-service attack is carried out by flooding the targetedhost or network with traffic until it becomes unable to react or simply fails,denying genuine users access. While an organization’s resources and servicesare unavailable, DoS attacks can cost them both time and money. Firewalls:acting similarly to gates, it secures the boundaries between your network andthe internet. Firewalls control network traffic by allowing permitted trafficto pass while blocking non-authorized traffic.

Firewalls help protect yournetwork in a variety of ways. In addition to the filtering features you havealready learned, firewalls provide the following security features:

Flood Guard-Rules can limitthe bandwidth of traffic from hosts, reducing the chances of a host floodingthe network.

Loop Protection-The firewallcan check the message address to see if the message is being sent in aninfinite loop. This could be another form of flooding.

Network Isolation-Filterrules enforce partitioning between networks and prevent traffic from movingfrom one network to another.

A packet filtering firewall isa network security method for controlling data flow into and out of a network.It’s a network security technique that allows packets to pass across thenetwork while also controlling their flow using a set of rules, protocols, IPaddresses, and ports. Stateful inspection, also known as dynamic packetfiltering, is a firewall mechanism that monitors the status of activeconnections and uses this information to determine which network packets areallowed to pass. Stateless inspection, which is often used instead of statelessinspection and static packet filtering, is best suited for Transmission ControlProtocol (TCP) and equivalent protocols, but it handles protocols such as UserDatagram Protocol (UDP) (UDP). An application-proxy firewall is a serverprogram that recognizes the type of data being sent (HTTP or FTP, for example).It operates at a higher level in the protocol stack than packet-filteringfirewalls, giving it greater options for accessibility monitoring andmanagement. An application gateway functions as a distributor when dispatchingmessages from internal clients to the outside world, changing the sourceidentification of the client packets. This achieves two objectives: It does twothings: first, it hides the internal client from the rest of the Internet, andsecond, it works as an Internet proxy agent for the client.

2^nd Response: Theminute that you connect to any network comes that factor of risk. Again, whatrisk will you accept is your premise to operate your network. There are threecategories of risk that are outlined in the book but believe me there are awhole lot more than that, but for the purpose of our discussion, risks are ofthree types. Reconnaissance is the process that hackers and crackers use tolearn what the characteristics of a network. The types of things that areattempted to be learned or gleaned are IP ranges, ports, services as well asthe data and information of the organization. They will use tools like Wireshark, Snort and other tools like Whois tolearn about the organization. The are several ways to discourage would behackers. Lets start with the firewalls. There has to be limited traffic thatis allowed inbound to a network, but Firewalls do not stop everything.Intrusion Detection and Intrusion Prevention are tools that help stop DDOS, WebServer and FTP attacks. At the network layer of the OSI model you can useNetwork Address Translation (NAT). The book mischaracterizes NAT as anotherpublic IP space. That is incorrect. NAT is private IP space that is defined byeach class of network. The main point of NAT was to extend ipv4 exhaustion, butan unforeseen advantage is that it protects the internal IP space as it is nonroutable. This makes the IP space harder to see, but not impossible. At thelayer 2 which is the data link layer of the OSI model, you can use MACfiltering on wireless access points and other network devices, but in mostenterprise networks ISE is used to accomplish port security. Eavesdropping iswhat hackers do to listen to communication lines in a very passive mode. Thisterm was actually born from telecommunication systems. Network eavesdropping isvery similar in that hacker has physical access to cable/wire closets., butphysical access is not the only way which this can be done, but there is morethan one way to make listening difficult or if not impossible. Encryption isthe best way to shield communications and data from the eavesdroppers.  Switched networks are another way toaccomplish this by segregation of networks. As stated, earlier NAT configurations,and finally lock your closets and limit access to only a select group. DenialOf Service which is characterized by sending a large amount of data packetssent to a network of a specific host. There are two types of attack. The Denialof Service is one system set up to send packets to disrupt or deny service. Theother is a DDOS attack which is usually set up by a hacker creating and using aBotnet to launch a more persistent attack with overwhelming amounts of packets.There are several methods to stop these attacks, but the firewall is not theonly thing that can stop these types of attacks. Actually, Intrusion DetectionSystem (IDS) and Intrusion Prevention System (IPS) are better options to knowwhen this type of attacks and other attack are in progress. Also, UnifiedThreat Management (UTM). Web Security Gateways also do what UTM do, but withoutthe bandwidth cost. In Closing, there are many more tools than were mentioned,and when you design a network, you have to use the options that best fit thesize of the network and the resources that need protection. Threats and riskschange constantly. It is best to continue to read and learn what those threatsare so you can remediate them, but also, the most important factor on a networkis the human threat imposed by users. Training and Awareness are the best wayto address this threat.

NOTE: PLEASE RESPOND SEPARATELYTO THESE 2 DIFFERENT RESPONSES! THANK YOU!