Introduction to Network Security Monitoring

Name: Introduction to Network Security Monitoring
Author: Jerry Smith

Learn about the importance of defense-in-depth and the tools you can use to protect your network

Preview the first lesson free — get full access to all 3 lessons.

Course: On-Demand

Hello. My name is Jerry Smith. In this lesson, you will learn about Defense in Depth and basic network architecture. Defense in Depth is a strategy that. Uses multiple defense points or layers to. Safeguard an organization's data. That way, any single layer can be compromised without the entire system failing. The three primary focus areas for defense in depth are prevention. Ideally, you want to prevent adversaries from accessing your environment. However, you can't prevent the adversary from getting in. You'll want immediate detection. Once the intrusion has been detected, the appropriate response will be executed. Defense in Depth has three primary types of controls. Physical controls are aptly named as they. Are physical items that can help secure your data. They include locked doors, fences or gates, and security guard, among other things. Technical controls are the topic of this course. You'll find items such as firewalls configuration management, intrusion detection and prevention, and multifactor. Authentication, which requires at least two methods of authentication to allow access. Administrative controls typically consists of policies and procedures. As I mentioned in the introduction to. This section, defense in depth is also. Known as layered security. Here's a typical visualization your perimeter security. Is your first line of defense against those outside adversaries. It typically consists of your edge firewall. The next layer is your network layer. Here you'll find your intrusion detection systems and intrusion prevention systems or IDs, and IPS, which again is the topic of this course. The host layer consists of operating system level security to include antivirus OS updates, file permissions, and much more. The application layer would involve web access, firewalls secure, configuration of databases, or web. Server security, depending on what application you're running. And lastly, this diagram ends with the crown jewels of any organization's It infrastructure the data itself. While no two businesses have the exact same network, there are typical networking components that most enterprise level organizations have. You'd be hard pressed to find an organization without an edge firewall routers are. Devices that connect two or more disparate networks together. Simply put, you can't talk to the. Outside world without one. Switches allow multiple devices within a network to communicate with one another. And of course, wireless access points are ubiquitous at this point. And intrusion detection systems and intrusion prevention systems are prevalent in most enterprise level networks. Here you see a typical enterprise level. Network from top to bottom. You see we have the outside world. Or public Internet represented with the cloud. From there you have your edge firewall device that feeds into the core router. Next you'll see the intrusion prevention system. Or IPS, that hands traffic off to the core switch. On the far left, the systems or. Server level switch, and the intrusion detection system or IDs. More on that in a moment. And on the right, you see you. Have your end user switch and devices. Stay tuned for the next lesson where. We will continue the discussion with an introduction to intrusion detection and intrusion prevention systems. Thanks for watching.

Beginner Provider : Jerry Smith 3 Lessons · 10m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

Organizations often focus their energies on their network perimeter defense and endpoint defense and often overlook the areas in between. By embracing the principles of defense-in-depth, your organization will be much stronger in its defensive posture and better able to protect its data. From a practical standpoint, adding an Intrusion Detection System or an Intrusion Prevention System to your network defense will serve as a significant upgrade from a firewall-only defense. Knowing how to use tools like pfSense makes this even easier as it is available to run as a virtual machine and can host your IDS and IPS systems using freely available software packages.

In this module on Introduction to Network Security Monitoring, you will learn about defense-in-depth and Intrusion Detection and Prevention Systems (IDS/IPS). We will also discuss and explain pfSense, as well as explore basic networking architecture, the need for a layered defense, and how to utilize pfSense to host your IDS and IPS technologies. By the end of this course, you will have a solid understanding of the foundations of network security monitoring.

What You'll Learn

Learn the principles of defense-in-depth and why a layered defense is needed
Understand basic network architecture and the role of Intrusion Detection and Prevention Systems (IDS/IPS)
Explain how to use pfSense in a lab or production environment
Explore how to utilize pfSense to host your IDS and IPS technologies
Recognize how adding an IDS or IPS upgrades a firewall-only defense

Key Takeaways

Organizations often focus on perimeter and endpoint defense while overlooking the areas in between, leaving gaps in their defensive posture.
Embracing defense-in-depth makes an organization stronger and better able to protect its data.
Adding an Intrusion Detection System or Intrusion Prevention System is a significant upgrade over a firewall-only defense.
pfSense can run as a virtual machine and host IDS and IPS systems using freely available software packages.
The course builds a solid understanding of the foundations of network security monitoring.

Frequently Asked Questions

What will I learn in this course?

You will learn about defense-in-depth and Intrusion Detection and Prevention Systems (IDS/IPS), explore basic networking architecture and the need for a layered defense, and learn how to use pfSense to host your IDS and IPS technologies.

What topics do the lessons cover?

The lessons cover the need for defense in depth and basic network architecture, an introduction to IDS/IPS, and an introduction to pfSense.

Why is pfSense used in this course?

pfSense is covered because it is available to run as a virtual machine and can host your IDS and IPS systems using freely available software packages, making a layered defense easier to implement.

What skills will I gain from this course?

You will gain skills in Intrusion Detection Systems, Intrusion Prevention Systems, Intrusion Detection and Prevention, Network Intrusion Detection and Prevention, Network Monitoring, and Network Security.

What will I understand by the end of the course?

By the end of the course you will have a solid understanding of the foundations of network security monitoring.