InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Guide to IPS inline deployment, automatic threat blocking, false positive management, and integration with security infrastructure.
Overview
Intrusion Prevention Systems (IPS) is a critical component of organizational defense strategy. As networks grow more complex with cloud services, remote workers, and IoT devices, understanding and implementing proper network security controls becomes increasingly vital.
Key Concepts
Network security operates across multiple layers of the OSI model, with different controls appropriate at each layer:
| Layer 7 (Application) | WAF, Application proxies, DLP |
| Layer 6 (Presentation) | SSL/TLS encryption |
| Layer 5 (Session) | Session management, authentication |
| Layer 4 (Transport) | Stateful firewalls, TCP/UDP filtering |
| Layer 3 (Network) | Routers, IPSec, IDS/IPS, ACLs |
| Layer 2 (Data Link) | VLANs, 802.1X, MAC filtering |
| Layer 1 (Physical) | Physical security, cable management |
Architecture and Deployment
Example
Typical Enterprise Network Security Architecture:
====================================================
Internet
|
[Edge Router + ACLs]
|
[Next-Gen Firewall]──→ DMZ (Web servers, Mail relay)
|
[IPS/IDS]
|
[Core Switch]
|
+---+---+---+---+
| | |
VLAN1 VLAN2 VLAN3
Users Servers IoT
Implementation
Example
import ipaddress
from dataclasses import dataclass
from typing import List
from enum import Enum
class Action(Enum):
ALLOW = "allow"
DENY = "deny"
LOG = "log"
@dataclass
class SecurityRule:
"""Network security rule definition."""
name: str
source: str
destination: str
port: int
protocol: str
action: Action
priority: int = 100
class NetworkSecurityEngine:
"""Basic network security rule engine."""
def __init__(self):
self.rules: List[SecurityRule] = []
self.default_action = Action.DENY # Default deny
def add_rule(self, rule: SecurityRule):
self.rules.append(rule)
self.rules.sort(key=lambda r: r.priority)
def evaluate_packet(self, src_ip: str, dst_ip: str,
dst_port: int, protocol: str) -> dict:
"""Evaluate a packet against security rules."""
for rule in self.rules:
if self._matches_rule(rule, src_ip, dst_ip, dst_port, protocol):
return {
"action": rule.action.value,
"rule": rule.name,
"matched": True
}
return {"action": self.default_action.value, "rule": "default_deny", "matched": False}
def _matches_rule(self, rule, src_ip, dst_ip, dst_port, protocol):
try:
src_match = ipaddress.ip_address(src_ip) in ipaddress.ip_network(rule.source, strict=False)
dst_match = ipaddress.ip_address(dst_ip) in ipaddress.ip_network(rule.destination, strict=False)
port_match = rule.port == 0 or rule.port == dst_port
proto_match = rule.protocol == "any" or rule.protocol == protocol
return src_match and dst_match and port_match and proto_match
except ValueError:
return False
# Example firewall rules
fw = NetworkSecurityEngine()
fw.add_rule(SecurityRule("Allow HTTPS out", "10.0.0.0/8", "0.0.0.0/0", 443, "tcp", Action.ALLOW, 10))
fw.add_rule(SecurityRule("Allow DNS", "10.0.0.0/8", "10.0.0.1/32", 53, "udp", Action.ALLOW, 20))
fw.add_rule(SecurityRule("Block all", "0.0.0.0/0", "0.0.0.0/0", 0, "any", Action.DENY, 999))
# Test
result = fw.evaluate_packet("10.0.1.50", "8.8.8.8", 443, "tcp")
print(f"HTTPS to internet: {result['action']} ({result['rule']})")
result = fw.evaluate_packet("10.0.1.50", "10.0.2.100", 22, "tcp")
print(f"SSH internal: {result['action']} ({result['rule']})")
Best Practices
| Practice | Description |
|---|---|
| Default deny | Block all traffic not explicitly allowed |
| Segmentation | Separate networks by function/sensitivity |
| Encryption | Encrypt data in transit (TLS, IPSec) |
| Monitoring | Continuous traffic analysis and alerting |
| Patch management | Keep network devices firmware updated |
| Access control | 802.1X for network access authentication |
| Redundancy | Failover for critical security infrastructure |
Common Attacks and Defenses
| Attack | Description | Defense |
|---|---|---|
| DDoS | Flood network with traffic | Rate limiting, CDN, scrubbing |
| Man-in-the-Middle | Intercept communications | TLS, certificate pinning |
| ARP Spoofing | Redirect traffic via ARP | Dynamic ARP inspection, static ARP |
| DNS Poisoning | Redirect DNS queries | DNSSEC, DNS over HTTPS |
| Port Scanning | Discover open services | Firewall rules, port knocking |
Interview Questions
- What is the difference between a firewall and an IDS/IPS?
- A firewall controls traffic flow based on rules (allow/deny). An IDS passively monitors and alerts on suspicious traffic. An IPS actively blocks detected threats inline. Firewalls are preventive, IDS is detective, IPS is both.
- Explain the concept of network segmentation and its security benefits.
- Network segmentation divides a network into isolated zones (VLANs, subnets). Benefits: limits lateral movement after breach, reduces attack surface per segment, enables granular security policies, improves monitoring, and helps compliance (isolating regulated data).
- What is the difference between stateful and stateless firewalls?
- Stateless firewalls examine each packet independently against rules (fast but limited). Stateful firewalls track connection state (TCP handshake, session) and make decisions based on the full context of the communication. Stateful is more secure but uses more resources.
- How would you detect a Man-in-the-Middle attack on a network?
- Monitor for ARP anomalies, certificate warnings/changes, unexpected TLS downgrades, duplicate IP/MAC pairs, DNS resolution inconsistencies, and unusual traffic patterns. Network monitoring tools and IDS signatures can automate detection.
- What is a DMZ and why is it important in network architecture?
- A DMZ (Demilitarized Zone) is a network segment between the internet and internal network containing public-facing services. It limits exposure — if a DMZ server is compromised, the attacker still faces another firewall before reaching internal resources.
Continue the lesson path
Study next in this module
01Network SecurityIntrusion Detection Systems (IDS)Understanding IDS types including network-based and host-based systems, signature vs anomaly detection, and deployment strategies.02Network SecurityNetwork Monitoring and AnalysisTools and techniques for network traffic monitoring, packet analysis, flow data, and detecting suspicious network activity.03Network SecurityFirewalls in Network SecurityComplete guide to firewall types, architectures, rule configuration, stateful inspection, and next-generation firewall capabilities.04Network SecurityNetwork Security BasicsFundamental concepts of network security including protocols, layers, threats, and defense mechanisms for protecting network infrastructure.