Information As An Asset Can Not Be Overemphasized

Despite the presence of network security devices such as firewalls and other security appliances, today's corporate networks are still vulnerable to both internal and external attacks by hackers intent on creating havoc. By proactively

Reflecting on several previous studies that have been carried out to compare the performance of the two NIDS, indicated Snort to be efficient in various issues. For instance, the comparison of Snort version 2.8.5.2 to Suricata version 1.0.2 was a clear indication of the strength of each system engine when subjected to the protection of the network. Their testbed incorporated the Ubuntu 10.04 which is a Virtual device accommodated on a VMWare Terminal 6.5 virtual setting operating on a 2.8GHz Quad-Core Intel Xeon CPU that had a 3GB RAM. The research was examining the quickness of detection and the accurateness of under changing rates of network and CPU usage (Albin, 2011). The control of the CPU used the Cpulimit with Tepreplay controlling the network bandwidth. The alert signals was accomplished by introducing six unknown malware that was created using the Metaspoilt framework. The results characterized Snort being efficient with system properties as compared to Suricata, but when functioning in a multi-CPU setting Suricata was extra efficient as a result of fewer false negatives

tools will help to detect intrusions and other suspicious activities on the network. The third challenge is to improve the

For the purpose of this assignment snort will be used as intrusion detections systems which is an open source IDS, snort has the ability to monitor traffics in real time and packet locking its also inspecting each packets as they enters into the network, Snort can be used as packet sniffer to analyse the network traffic in order to detect any bizarre looking packets or payloads which might have malicious data in it. Snort can also detect payloads attacks against the network or host system including but not limited to stealth port scan, and buffer overflows.

Today’s NCPS leaves the DHS at risk of inadvertently allowing potentially malicious material into federal computer networks. Currently, The NCPS operates by comparing known patterns of malicious data, “signatures”, to current network traffic. The DHS uses these signatures to filter through copious amounts of network traffic and automatically locate potential cyber threats entering federal computer networks. This information is than sent to DHS analysts who effectively neutralize this information while noting its defining characteristics, for the pursuit of future

CSEC 630 Lab2 -Intrusion Detection System and Protocol Analysis Lab (n.d.). University of Maryland University College. Retrieved from: https://learn.umuc.edu/d2l/common/viewFile.d2lfile/Database/NzkyMzkw/CSEC630_lab2_LEO.pdf?ou=33745

The National Institute of Standards and Technology (NIST) defines Information Security Continuous Monitoring as “maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions” (Dempsey, et al., 2011). NIST advocates for continuous monitoring of information security systems, by the process of defining the program, establishing it, implementing the program, analyzing and reporting findings, responding to the findings, and reviewing and updating the program. Additionally, they believe that in order to be more cost effective, and to improve efficiency and reliability of the monitoring program, automation would be the way to go. By making use of the latest trends in technology such as machine learning and data mining, algorithms can be developed to detect patterns, which would ordinarily be missed by the human eye. This is especially true of voluminous data where it is time consuming and just plain difficult for personnel to sift through. Such implementations leaves the security professionals with time to tackle the issues which would require human involvement (Dempsey, et al., 2011). One example of an automated monitoring system is a firewall. The job of a firewall is to monitor and regulate the network traffic coming into and out of a system, which could be as small as a single home computer connected to the internet, to several thousands of devices in an organization the size of Amazon or

Network Traffic Monitoring and analysis is essential to more effectively troubleshoot and resolve issues when they occur, to not bring network services to a standstill for extended periods. Numerous software tools are available to help administrators with the monitoring and detects cyber threats in network traffic. This paper will discuss software that can monitor Network Traffic, which helps detect cyber threats. The following is software based monitoring that detect cyber threats;

The goal of intrusion detection is to monitor network assets, detect anomalous behavior, and identify misuse within a network (Ashoor, Gore, 2011). An intrusion detection system (IDS) is a device or software application that monitors network system activities for malicious activity or policy violations and produces reports to a management station (Kashyap, Agrawal, Pandey, Keshri, 2013), additionally there are three types of IDS:

Intrusion Detection Systems – IDS should be installed that contain the capabilities to monitor the network and send alerts if odd or different behavior is observed.

Network traffic visualization method designed by Mazurczyk (2012) focuses on network anomaly detection principles. Mazurczyk’s main purpose of doing his research was to detect anomalies in network traffic flow, that can cause malicious actions that could compromise network security. Typical anomaly detection methods instituted across networks focus on discovering illegal activities orchestrated by probable attackers (Mazurczyk, et al., 2012). Current security devices lack the effectiveness needed in today’s immense traffic volumes that need current real-time

Intrusion detection systems are there to help an information system prepare for and deal with attacks. They collect information from a variety of system and network sources and then analyze the information and activity logs searching for information on potential security problems. Some of the main tasks of an IDS are to monitor and analyze the user and system activity on a network, to audit the systems

Internet has grown leap and bounds over the last few years. This has resulted in a number of computer security breaches on the Internet. Most of the computers that use Internet are vulnerable to attack. Due to this reason, Intrusion Detection systems have grown rapidly and there is an ongoing research since it’s a developing field. ID (Intrusion Detection) is a type of a security management system that gathers and analyzes information to identify security breaches, which include both, attacks from outside the organization and attacks from inside as well (misuse). ID includes analysis of abnormal activity, tracking user policy violations, assessing systems and file integrity and vulnerability. It helps us differentiate the normal behavior of system and helps us obtain any abnormal activity that is taking place. This can be done easily using data mining and it helps increase its sustainability to attacks.

Securing the network and associated systems for a corporation as ginormous as UTC, which conducts business globally and employs over 200,000 employees, is a daunting task. Regardless the size of UTC now or in the future, it has the legal and ethical obligation to provide adequate InfoSec. In fact, it must have cutting edge technology such as: robust firewalls, virtual private networks (VPNs), intrusion detection and prevention systems (IDPSs), and wireless access points (WAPs) to ensure data can be accessed globally without sacrificing security. Packet filtering firewall protection is commonly used to examine all the packet headers that go in or out of a system; however, the implementation architecture may combine several firewall categories to increase the security effectiveness (Whitman & Mattord, 2017).

In an e-commerce world, organizations are susceptible to hackers and intruders. Thus creating the information technology protection systems which is used to reduce the possibility of intrusions from occurring. Intrusions occur by uninvited outsiders (sometimes intruders can be internal users like employees) who try to access an organization’s information system using the internet with the intent to gain competitive advantage of some sort. Organizations depend on security technology to avoid loss from security breach, as well as to improve their efficiency and effectiveness. However, firewalls are also vulnerable to errors, and implementing a security technology comes with challenges and critical decisions that can possibly cause a financial burden on the organization if done without seriousness and commitment. “Information security is about managing risk, and managing risk is about discovering and measuring threats to information assets; and taking actions to respond to those threats” (Al-Awadi, & Renaud, 2007, p.3). This paper will discuss a few aspects that are involved with firewalls and intrusion detection systems.