IPS NAT and VPN.pptx
- 1. IDS, IPS, NAT and VPN
- 2. What is an Intrusion Detection System (IDS)? ๐ ถ Itโs a technique of detecting unauthorized access to a computer system or a computer network. ๐ ถ The detection techniques used by IDS are as follows: 1. Signature based Intrusion Detection Technique 2. Anomaly based Intrusion Detection Technique ๐ ถ Signature based detection scan all the packet on the network and compare them against the database of signatures. Example: E-mail an attachment filename of โfreepics.exeโ, which are characteristics of a known form of malware. ๐ ถ Anomaly based detection perform comparison against the established baseline. Example: The number of failed login attempts for a host, and the level of processor usage for a host in a given period of time.
- 3. What is Intrusion Prevention System (IPS)? ๐ ถ They not only detect the intrusion but also take some preventive actions and defend the network by stopping the intruders. ๐ ถ The detection techniques used by IPS are as follows: 1. Network-based Intrusion Prevention System (NIPSs) 2. Host-based Intrusion Prevention System (HIPSs) ๐ ถ NIPSs performs packet sniffing and analyze network traffic to identify and stop suspicious activity. ๐ ถ HIPSs monitors the characteristics & events of a single host, such as monitoring network traffic, system logs, running processes, file access and modification, and system and application configuration changes.
- 4. Honey token systems ๐ ถ Honey token is the security tool used for the purpose of intrusion detection. ๐ ถ Its concept is derived from honeypots and honeynets ๐ ถ A honeypot system is designed to attract hackers. ๐ ถ After an intrusion, network administrators and security specialists can determine how the attacker succeeded. ๐ ถ Then prevent subsequent attacks, and identify security gaps.
- 5. Conclusion ๐ ถ Honeypot technology has matured after a leap in its development. ๐ ถ This technology aims to lure hackers to a decoy system, thus delaying the attack and providing network security specialists a window of opportunity to prevent the threat. ๐ ถ The technology allows system administrators to know the launch address, verify if the security strategy is effective, and determine if the defense line is solid. ๐ ถ Network security can be improved when such technologies are combined with the honeypot system. ๐ ถ We believe that honeypot technology will play a crucial role in global network security.
- 6. NAT & PAT
- 7. Intro to NAT/PAT ยฉ 2002, Cisco Systems, Inc. All rights reserved. ICND v2.0โ6-7 7 NAT :- the NETWORK ADDRESS TRANSLATION is used to translate the local ip address on a network with the global or public ip addresses. Requirement of NAT when.. 1.you need to connect to the Internet and your hosts donโt have global unique ip addresses. We are using private addresses. 2. You change your network to another ISP and that require to renumber your network. Then using the nat we didnโt need to change our ip addresses. 3. You need to merge two internets with duplicate addresses. 4.No any host from the foreign network can access our local network. Local network security.
- 8. NAT typesโฆโฆโฆโฆโฆโฆโฆโฆโฆโฆโฆโฆ Static NAT:- it is the type of Nat that is designed to allow One-to-one mapping between the local ip addresses and global ip addresses. BUT keep in mind that static NAT require that YOU MUST HAVE ONE REAL INTERNET IP ADDRESS FOR EVERY HOST ON YOUR NETWORK. Dynamic NAT:- this gives the ability to map an unregistered ip address with a registered ip address from out of pool of ip addresses. you donโt have to statically configure your router to map an inside address with an outside address like in static NAT. But you must have the sufficient number of ip addresses for every user who`s going to transfer packets with internet NAT overloading{(PAT-Port Address Translation)}:- this is the most popular type of the NAT configuration it is the type of dynamic NAT. that maps multiple local ip addresses with a single registered ip addresses. __Many โto-One. But it is mostly used because of its feature of using the special port number for every translated addresses with the global ip address through which we can attach unlimited no. of users with the internet using a single ip address only NAT overloading{(PAT-Port Address Translation)}:- this is the most popular type of the NAT configuration it is the type of dynamic NAT. that maps multiple local ip addresses with a single registered ip addresses. Many โto-One. But it is mostly used because of its feature of using the special port number for every translated addresses with the global ip address through which we can attach unlimited no. of users with the internet using a single ip address only ICND v2.0โ6-8
- 9. An IP address is either local or global. ICND v2.0โ6-9 โข โข Local IP addresses are seen in the inside network.
- 10. ICND v2.0โ6-10
- 11. VPN โข VPN stands for Virtual Private Network. โข A virtual private network offers a higher degree of protection and privacy as youโre surfing the web, whether at home or outside. โข A VPN creates a secure connection over public networks (such as the wi-fi in public transport, hotels, or your favorite cafรฉ) as well as home networks. โข Not only do they provide better security for you and your devices, but they can also help you bypass censorship and access geographically blocked content on the internet from anywhere! โข It lets you remotely connect to a private network. 11
- 12. VPN โข A virtual private network (VPN) extends a private network across a public network, and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. โข Applications running on a computing device, e.g., a laptop, desktop, smartphone, across a VPN may therefore benefit from the functionality, security, and management of the private network. Encryption is a common, though not an inherent, part of a VPN connection. 12
- 13. Types of VPN 13 There are two basic VPN types : I. RemoteAccess VPN II. Site โ to โ Site VPN III. SSL VPN
- 14. Remote access VPN 14 โข Remote access VPN allows a user to connect to a private network and access its services and resources remotely. The connection between the user and the private network happens through the Internet and the connection is secure and private. Allow employees to access the companyโs internet from outside the office.
- 15. Site-to-site VPN 15 โข Site-to-site VPNs allow collaborators in geographically disparate offices to share the same virtual network. โข Basically, Site-to-site VPN create a virtual bridge between the networks at geographically distant offices and connect them through the Internet and maintain a secure and private communication between the networks. โข Site-to-site VPN to connect the network of one office location to the network at another office location
- 16. VPN systems 16 VPN systems may be classified by: ๏ง the tunneling protocol used to tunnel the traffic ๏ง the tunnel's termination point location, e.g., on the customer edge or network-provider edge ๏ง the type of topology of connections, such as site-to-site or network-to- network ๏ง the levels of security provided ๏ง the OSI layer they present to the connecting network, such as Layer 2 circuits or Layer 3 network connectivity ๏ง the number of simultaneous connections
- 17. Secure VPN protocols include the following: 17 โข Internet Protocol Security (IPsec) โข Transport Layer Security (SSL/TLS) โข Datagram Transport Layer Security (DTLS) โข Microsoft Point-to-Point Encryption (MPPE) โข Microsoft Secure Socket Tunnelling Protocol (SSTP) โข Multi Path Virtual Private Network (MPVPN). โข Secure Shell (SSH) VPN
- 18. Vpn Authentication 18 โข User-created remote-access VPNs may use passwords, biometrics, two- factor authentication or other cryptographic methods โข Network-to-network tunnels often use passwords or digital certificates. They permanently store the key to allow the tunnel to establish automatically, without intervention from the administrator.
- 19. Vpn Routing 19 โข Tunnelling protocols can operate in a point-to-point network topology that would theoretically not be considered a VPN because a VPN by definition is expected to support arbitrary and changing sets of network nodes โข But since most router implementations support a software-defined tunnel interface, customer-provisioned VPNs often are simply defined tunnels running conventional routing protocols
- 20. Unencrypted tunnels 20 โข Some virtual networks use tunneling protocols without encryption for protecting the privacy of data. While VPNs often do provide security, an unencrypted overlay network does not neatly fit within the secure or trusted categorization. For example, a tunnel set up between two hosts with Generic Routing Encapsulation (GRE) is a virtual private network but is neither secure nor trusted.
- 21. Trusted delivery networks: 21 Trusted VPNs do not use cryptographic tunneling; instead they rely on the security of a single provider's network to protect the traffic. โข Multi-Protocol Label Switching (MPLS) often overlays VPNs, often with quality-of-service control over a trusted delivery network. โข L2TP which is a standards-based replacement, and a compromise taking the good features from each, for two proprietary VPN protocols: Cisco's Layer 2 Forwarding (L2F) (obsolete as of 2009) and Microsoft's Point-to-Point Tunneling Protocol (PPTP).
- 22. VPNs vs Proxy Servers 22 โข A proxy server is a middle man that masks your IP address on the internet, without doing anything to secure your data. If changing your IP address is the only task youโre looking for, a proxy might be a good option. โข However, a VPN will change your IP address while also encrypting your information. You can think of it as a two in one service. amazing properties: โข It's fast. โข It's easy to take with you wherever you go. โข It's able to completely hide you from any other boats or submarines. โข It's dependable. โข It costs little to add additional submarines to your fleet once you've purchased the first one.
- 23. Thank you