Firewalls And Intrusion Detection Systems Essay

Despite the presence of network security devices such as firewalls and other security appliances, today's corporate networks are still vulnerable to both internal and external attacks by hackers intent on creating havoc. By proactively

The National Institute of Standards and Technology (NIST) defines Information Security Continuous Monitoring as “maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions” (Dempsey, et al., 2011). NIST advocates for continuous monitoring of information security systems, by the process of defining the program, establishing it, implementing the program, analyzing and reporting findings, responding to the findings, and reviewing and updating the program. Additionally, they believe that in order to be more cost effective, and to improve efficiency and reliability of the monitoring program, automation would be the way to go. By making use of the latest trends in technology such as machine learning and data mining, algorithms can be developed to detect patterns, which would ordinarily be missed by the human eye. This is especially true of voluminous data where it is time consuming and just plain difficult for personnel to sift through. Such implementations leaves the security professionals with time to tackle the issues which would require human involvement (Dempsey, et al., 2011). One example of an automated monitoring system is a firewall. The job of a firewall is to monitor and regulate the network traffic coming into and out of a system, which could be as small as a single home computer connected to the internet, to several thousands of devices in an organization the size of Amazon or

Firewalls protect sites from an exploitation of inherent vulnerabilities in the TCP/IP protocol suite (Wack, Cutler, & Pole, 2002). Additionally, firewalls help mitigate security problems associated with insecure systems and the problems inherent in providing robust system security for large numbers of computers. There are several types of firewalls, ranging from boundary routers that can provide access control on Internet Protocol packets, to more powerful firewalls that can close more vulnerability in the TCP/IP protocol suite, to even more powerful firewalls that can filter on the content of the traffic (Wack et al., 2002).

Information security enabled by technology must include the means of lowering the impact of intentional and unintentional errors entering the system and to prevent unauthorized internally or externally accessing the system  actions to reduce risk data validation, pre-numbered forms, and reviews for duplications. It is crucial that the mission plan include the provision of a disaster recovery and business continuity plan. On the other hand, there is much more intrusion activity today than ever before. Obviously, there is an increased concern for attacks through companies’ network in an effort to either commit malice or affect the integrity of an organization’s most valuable resource. Therefore, it is important that companies do not get complacent in their IT infrastructure security. The fact of the matter, there is no perfect system; however, it behooves organizations to protect their information by way of reducing threats and vulnerabilities. Moreover, Whitman and Mattord (2010) said it best, “because of businesses and technology have become more fluid, the concept of computer security has been replaced by the concept of information security. Companies

These proposals and systems suggestions can minimize the vulnerabilities associated with any compromises or intrusions within the network. Deploying an intrusion detection system is an essential security strategy for monitoring a network information system for abnormal or authorized activity. An intrusion detection system (IDS) is set of tools which monitor a network topology by providing a system administrator with the overall picture of how the system is being utilized. Executing an IDS will make a difference in creating a defense in depth architecture to be more compelling in recognizing any form of malicious activities. The capacity of the IDS is to monitor and survey the network traffic without affecting network activity. IDS tools gather information and analyzes it against a pre-characterized manage set, and against a set of known assault 'marks'. The IDS can scan port numbers and to determine if any breaches or attacks are occurring (Kuipers,

Even the focus of securing networks has moved from just intrusion detection to intrusion detection and prevention (Golomb, 2003). Although most companies have significant investments in physical security (security guards and laptop locks) and data security (IDS/IPS and firewalls), one of the biggest and yet most misunderstood threats is from internal sources.

In the last decade, more and more companies have started to look into e-commerce to connect them to the infinite world of global suppliers, partners, consumers and much more. This boom in technology has placed multiple assets are risk from a security stand point allowing hackers/crakers and anyone on the internet to gain access to these network and gain information or try to jeopardize business to a point where it stand stills.

With cyber-attacks on organizations becoming more frequent, and with the need to keep organizations secure, counter-measures must be taken. While firewalls can help to prevent attacks, simply dropping packets and declining services is becoming an inefficient message to send to attackers. Taking existing perimeter defense techniques, like firewalls, and amplifying them to create a new style of device that will respond to attacks is the next step in firewall technology. With these Offensive Perimeter Devices (OPDs), organizations can fight back. Imagine being able to replicate the attack that is in progress and use it against the attackers. The OPD will help to eliminate Denial of Service attacks and ultimately keep an organization up

Intrusion detection is similar in concept to a burglar alarm on a car. There is the lock system to prevent access to a car, similar to a firewall, and there is the alarm system, the intrusion detection system. Intrusion Detection Systems (IDS) are there to compliment the network or computers firewall, if or when there is a breach, it is the IDS that is able to identify it and then alert the administrator. Firewalls are an effective way for filtering information coming in to your network from the internet and are a good source of protection, but there are ways to circumvent a firewall which could leave you defenseless. An IDS monitors the firewall for breaches and also monitors the traffic on the organizations network for any anomalies. This is important in the instance of an external user connecting to an organizations infrastructure by connecting through an installed modem on the network, this form of attack cannot be caught by a firewall but an IDS is able to recognize the abnormal activity and report the intrusion to an administrator.

Thesis Statement: This paper will try to prove that the improper management of firewalls and the lack of strong security policies used in enterprises will cause data breaches from within the enterprises. To try and prove this, the paper will shed light on various data breach scams that occurred to companies such as Target, Home Depot, Ashley Madison and OPM. It will also try to create a model for ideal security policy making for companies in the e-commerce domain.

Hardware firewalls are specialized network systems that contain specialized software and hardware. When they are configured appropriately, these firewalls provide a protective barrier that hide an entity’s internal computers and applications from the outside world. Hardware firewalls can also shield organization department; for instance, the human resources from another department such as the finance department. Hardware firewalls are mostly applicable in scenarios where entities require a unitary information security umbrella with the capability of protecting multiple systems (CISCO, 2013). This reason points out why most FORTUNE 500 company networks have implemented hardware firewalls. However, since hardware firewalls are specialized devices or systems, they tend to be complicated, expensive, tricky to configure and difficult to upgrade. That is to say, they are best reserved for Information Technology experts or consultants trained to assess, install, configure and maintain such systems. In addition, the low-end hardware firewalls currently found in network devices such as routers and switches for homes and small businesses are also limited to locations. In other words, if an accountant or any other user from the accounting department takes their mobile devices or laptops to the road, their

Cybersecurity is one of the most important topics in business today; It is something that must be accounted for by all businesses, large or small, due to its ability to disrupt or even paralyze all business functions. With the increasing reliance of computer systems into enterprises today, it is no wonder why the most dangerous threats are in cyberspace. The dangers of these threats are scary to small and medium-sized business owners, and they are left wondering how to protect themselves. Preventative measures are the major thing a business can do to shield their services or products. The ‘bad actor’ hindrance of unauthorized entry into an infrastructure is a normal trouble in cybersecurity; The businesses of today are not immune to cybercrime, however they may be able to make themselves a difficult target that almost all hackers would disregard. Cyber-criminals can infect computer techniques making use of multiple tools to infiltrate and acquire data illegally. A part of this discussion deals with the necessary funding for confronting developing treats. Cybersecurity should be a priority to all businesses, due to the crippling effects an attack can have on an enterprise.

Configuration of Intrusion Detection (IDS) and Prevention System (IPS) for monitoring and preventing the attacks

Intrusion Detection Systems (IDS) are software or hardware designed to automatically monitor activities within a network of computers and identify any security issues . IDS have been around for at least 30 years since increased enterprise network access produced a new challenge, the need for user access and monitoring. As day-to-day operations grew increasingly dependent upon shared use of information systems, levels of access to these systems and clear visibility into user activity was required to operate safely and securely.

This IDS models define the baseline to describe normal state of network or host. Any activity outside baseline is considered to be an attack i.e. it detects any action that significantly deviates from the normal behavior. The primary strength is its ability to recognize novel attacks. The drawback is that it assumes that intrusions will be accompanied by manifestations that are sufficiently unusual so as to permit detection. These generate many false alarms as well and hence compromise the effectiveness of the IDS.