- [Instructor] When the A+ objectives
refer to Internet appliances,
they're referring to Internet security appliances,
and there's several of these that you should know
for the exams.
The first and foremost is firewalls.
The firewall is something that every organization
should have protecting its network,
and it can protect the network or an individual computer,
and it does this by closing ports
and stopping unwanted intrusion.
Network-based firewalls are generally used
to section off one portion of the network from another,
so here we have a firewall,
and this is blocking people on the Internet
who may want to gain unauthorized access
into the LAN over here.
So this firewall's gonna protect these computers.
But it might also section off things in such a way
where you can have other portions of the network,
you might have other LANs, or you might have a DMZ,
a demilitarized zone where there are servers,
such as web servers and FTP servers
that can be accessed by people from the Internet,
but only allowing them access to those services
like FTP and World Wide Web,
but the firewall will not allow access to these guys.
So a firewall might have the ability
to just protect from people on the Internet,
or it might have multiple connections
where you could have a connection to the Internet,
a connection to the DMZ, a connection to the LAN,
and maybe another LAN over here, in fact.
A separate LAN altogether.
Separate connectivity for all of those.
So firewalls are very important,
extremely important in network security.
It's the primary line of defense.
And so a firewall could run on an individual computer.
You know, you might have a firewall running here as software
but you really should have a firewall
on the entire network.
And that's gonna be this guy here.
That guy is gonna protect the entire network
from intrusion from the Internet.
Next is IDS and IPS,
and these are systems that either detect
or prevent unauthorized access.
Intrusion Detection Systems can determine
whether an unauthorized person
has attempted to access the network,
and then alert the system's administrator of its findings.
Intrusion Prevention Systems will not only detect
unauthorized access, but attempt to prevent it,
making the admin's job somewhat easier,
and these could be set up as an additional device, say here,
behind the firewall,
or they could be set up as software on a server.
There's a variety of ways to do this,
but the idea is it goes past what a firewall could do.
The firewall blocks ports.
And it's blocking all the ports that are open,
inbound from the Internet.
It's gonna close those, it's gonna shield those.
The IDS and the IPS will go to the next level.
They'll inspect the packets,
and see if someone is actually trying to get in
that should not be getting in.
So a little bit more advanced,
and more processing required with those,
and some more expense.
Generally, you install an IPS or an IDS as a network device,
a box that's installed here.
But it could be installed on a host computer as well,
perhaps on say a server.
You might have an FTP server,
and you want to monitor that guy
as far as who is gaining access to it,
and so you might install an IDS or IPS solution
for this server in software,
and that would be known as a HIDS or a HIPS.
Host-based Intrusion Detection,
or Host-based Intrusion Prevention,
and you can install that on the server.
But generally, it's the network that you want to protect.
You're looking at the whole network here
that you want to protect, all the computers.
And so that's gonna be a NIDS, Network Intrusion Detection,
or NIPS, that's what this guy's gonna be.
Network Intrusion Detection or Network Intrusion Prevention.
And install that right behind the firewall,
on your side of the firewall,
basically within the LAN but right next to the firewall.
And there's a variety of ways to do that installation.
There's other ways to do it.
That's not the only possibility,
but that's gonna be common.
So that's a little bit about IDS and IPS.
Now, there's other security options.
You know, you might have a small network,
and you might have a four-port SOHO router,
which acts as a firewall, and it acts as NAT device,
and it acts as a DHCP server,
and it acts as all these things.
So if you have a smaller network, you might have something
that kind of combines all this stuff,
and it might even do some packet analysis.
But for the larger networks,
if you want to combine this stuff together
what you're gonna be looking for is the UTM solution,
and that's Unified Threat Management.
A UTM gateway solution is a device that combines
multiple security features of individual devices.
It's the evolution of the firewall.
So you have your firewall here,
but it might actually take the place of this whole guy,
and act as a firewall,
replacing him but also incorporating features
like antivirus, anti-spam, content filtering,
and intrusion prevention that we mentioned before.
So you can put all these things together,
and add things like data loss prevention,
and it's kind of the next level of security.
It's gonna cost more money,
it's gonna require more administration,
and so usually it'll be larger companies
that'll use this type of solution,
but there are small versions as well for smaller companies.
The one drawback to the UTM
is that it's a single point of failure,
and so some organizations will install a second one.
Or they'll have the firewall and keep that firewall,
and then install the UTM adjacent to it.
So you have a couple options there.
It all depends on your network,
it all depends on your policies,
it all depends on how much money you have to spend.
Another term you should know for the CompTIA A+ exams
is endpoint management.
Endpoint management, or endpoint security management,
is a policy-based approach to network security.
It requires endpoint devices,
meaning PCs, laptops, and mobile devices,
to meet particular criteria
before they can be granted access to network resources.
Endpoint management servers are servers
that centrally control the discovery,
and the deployment, and the updating
of these security features on endpoint devices.
Companies such as Checkpoint and Sophos and QOS and BMC
offer endpoint management solutions.
So you might have a server located here on your LAN
that connects to the switch,
and takes control of those endpoints.
Those PCs, those laptops, those mobile devices,
and takes care of locating those devices, discovering them,
and deploying and updating the software
and security features to those endpoints.
You should also know about endpoint protection platforms.
These should be installed to all client computers,
PCs, laptops, mobile devices, and so on,
and should be updated across the board
in a synchronous fashion.
Examples of endpoint protection platforms
are McAfee, Norton, or Symantec, Kaspersky and so on.
These are generally all-in-one solutions
that have anti-virus, anti-spyware,
personal firewalls, spam protection, and so on.
They might simply be referred to as anti-malware suites,
and could be just a portion
of your entire endpoint management implementation.
So endpoint protection platforms
and endpoint management can go hand-in-hand.
When we start controlling the deployment
of this type of security software,
and other security features,
from, say, a centralized administration location,
such as server here on the LAN,
then we are most likely implementing the concept
of endpoint security management.