Let's take note of some additional network security controls.
The firewall does not disappear inside of the cloud.
Of course, now the various types of firewalls is somewhat of a discussion
of evolution, but there are three primary types, a static firewall that
behaves like the essential elements of a security group that is going to
allow or disallow ports and IP addresses, a dynamic firewall, which
examines the behavior of traffic, and then next generation firewalls get
down to a granular level of looking at lateral traffic within a network and
also being able to manage traffic based upon policy decisions so that it's
protecting a surface known as a protect surface or an attack surface.
In the static firewall example,
both the routers and the static firewall can assign static rules. On the
router, it is often called an access control list.
When the admin begins remote configuring of a web server,
he makes sure that he can screen access to the web server by means of his
source IP address, and that source IP address would be his router that's
connecting into that network. In order to allow users from around the world
to get access to public resources,
then they would have to have another rule that says permit this access
through this secure port. With dynamic firewalls and intrusion protection
systems, they share common characteristics.
They do stateful inspection of the nature of the traffic,
not just the port and the IP address, but the internal behavior and
choices and characteristics that the traffic can make. Anomalies may
include new types of traffic or an executable not seen in the network or
device before a flood of traffic that exceeds normal statistical traffic
flows or protocol anomalies that would detect a packet does not fit in a
defined packet structure.
Heuristic scanners will divert a suspicious packet into a safe
quarantine area. This area may be a sandbox environment that
allows the packet to be examined without posing a risk to the
rest of the system or the network.
The packet that can then be dropped or forwarded depending on
the results of the examination. Signature records known attacks
and using these records to compare them against behavior of
network activity in real time.
In the next clip, we will examine data encryption keys for storage services.