Now work security systems like the one shown here you play a specific role to try and prevent networks
from being compromised.
The main focus of these devices is to stop malicious traffic before it has a chance to reach an endpoint
on the network in the section.
We're going to take a brief look at each of these security systems firewalls are the core of our security.
They are placed on the network to create borders between trusted and untrusted networks called zones.
Firewalls are responsible for blocking most of the unwanted Melissas traffic trying to enter the network.
Stateful firewall inspection keeps track of the state of connections and helps firewalls keep a close
eye on what is traversing its zones state tables are used to track the current state of each connection.
This allows the firewall to permit or deny traffic based on if a connection is established and from
where traffic originates from a connection is considered to be established after the scene sent ack
and ack exchange is completed during a APCP three way handshake.
If a connection is sourced from a trusted zone to an untrusted zone the return traffic is permitted.
Since the connection is in the state table and it was initiated from a trusted zone.
However if traffic is sourced from an untrusted zone like the outside and there is not an access list
rule to permit the traffic inbound then the traffic will be denied.
One of the most basic yet powerful network security features is access lists access lists can be applied
on network devices to filter IP traffic based on source and destination IPs or Layer 4 port numbers
a good use case for access lists.
As for public facing devices that are behind firewalls.
If you have a web server that is accessible via the internet then you probably only want internet users
to be able to communicate with the server on TCAP port 443 for age.
Access And you would not want them to be able to communicate with other protocols like Remote Desktop.
The biggest security knownow for firewalls is to allow any any IP access to public facing devices.
If an attacker can access all the open ports on the host then it makes it a lot easier to find vulnerabilities
to exploit.
And that's why access lists are critical to block access before traffic can be processed at the application
layer.