3.6 Network Defenses

Firewalls filter traffic

A firewall inspects incoming and outgoing network traffic and allows or blocks it based on a set of security rules. Firewalls can be hardware devices, software, or both, and they act as a barrier between a trusted internal network and untrusted external networks like the internet, reducing exposure to attacks.

Detecting and preventing intrusions

An IDS (Intrusion Detection System) monitors network traffic and alerts administrators to suspicious activity, but does not block it. An IPS (Intrusion Prevention System) goes further by actively blocking or stopping detected threats in real time. Both compare traffic patterns against known attack signatures or unusual behavior.

Layered defenses and segmentation

Network segmentation divides a network into smaller zones, limiting how far an attacker can move if one segment is breached. Combined with firewalls, IDS/IPS, and honeypots (decoy systems that lure attackers to study their methods), organizations build defense in depth, using multiple overlapping layers of protection.

Key terms

Firewall

A device or software that filters network traffic based on security rules to block unauthorized access.

IDS (Intrusion Detection System)

Monitors traffic and alerts administrators to suspicious activity, but does not block it.

IPS (Intrusion Prevention System)

Monitors traffic and actively blocks or stops detected threats in real time.

Network segmentation

Dividing a network into smaller zones to limit the spread of an attack if one segment is breached.

Defense in depth

A security strategy using multiple overlapping layers of protection (firewalls, IDS/IPS, segmentation, etc.).

Try an AP-style question

An inbound SSH (port 22) request arrives. What happens?

1. It is denied
2. It is sent to port 443
3. It is logged only
4. It is allowed