Original subtitles

All right.

Hi, guys, hey, thanks for coming back.

I promise you that.

Yes, I'll be as excited as I was before, because in this lesson, we're going to learn a few security

features.

So I want to get started right away now.

You probably know it as a number of technological products and endpoints used increases day by day as

platforms integrate and well, integrate with each other and is threat surfaces change, the security

landscape gets a little blurry.

So when the news, somebody else is getting hacked.

So in this section, I want to give you a little bit of information about firewalls, intrusion detection

systems or IDs and intrusion prevention systems or IPS.

So first off, let's examine just what these three different systems actually are.

So a firewall, a traditional firewall, is a rule based decision making system, and it analyzes the

packet cipher protocol type, source address, destination address, source and destination ports.

So the packets don't match the firewall rules.

These packets are discarded and not taken in.

So basically, the firewall decides whether the packets coming into it from the network can go to the

places that they need to reach on the network.

Protection is provided by blocking traffic that does not comply with a rule specified in the fire.

Now there's also something called unified threat management.

You might have heard somebody refer to UTMB.

So the concept of UTMB firewalls, it's emerged naturally over time, according to the needs and development

of the security market.

So as new attacks and vulnerabilities are discovered, the firewall has been enhanced with new features

and functionality.

So therefore, we can now define it as a network device that is used as a software and hardware asset

or a combination thereof of both.

And that gathers some features of UTMB stateful filtering VPN, web proxy antivirus IDs, IPS, deep

packet analysis, and all of this goes on in a single center.

Now there is also something called the next generation firewall or Energy F.W..

So there's this concept called the next generation firewall.

Right?

And you have to be.

According to this kind of setup, it'll allow a single device to function as both a traditional firewall

and an intrusion prevention system or IPS.

So this next generation firewall and DFW, it's been developed with the motivation to address the lack

of performance seen in UTMB.

It will offer application control features and deep packet inspection features in a high performing

and compatible architecture.

In fact, there are other complementary features included in a UTMB firewall, such as web proxy and

virus and malware protection.

And they're not necessarily part of the NGF W architecture because these features have been removed

and typically outsourced.

But what that does is provides high scalability rates for like really large environments and DFW, whose

main contribution, though, lies in the technological advances and the visibility of applications resulting

from deep packet inspection, regardless of protocols and ports.

So together, these features not only allow attacks to be prevented, but also create a more dynamic

and efficient form of access control policies for today's security challenges.

So that UTM and the nji OFW differences we can talk about now.

And DFW is seen as a more suitable solution for high density traffic environments, especially for complex

businesses, telecommunications and companies centralizing large amounts of data traffic.

Also separating security assets in these situations is critical to the scalability and the resilience

of the network.

So therefore, these days, typically it's recommended that these smaller and medium sized businesses

where data flow is lower.

Well, they can go ahead and use that UTMB firewall.

But it's the NGF of our next generation firewall that can control packet content, source target and

user behavior without sacrificing performance.

So the most obvious and most important difference then between next generation firewalls and traditional

architecture is that this NGF F.W. has an architecture that can recognize the applications that generate

the traffic.

Now that's a really big deal.

So this situation enables the separation of applications and the creation of corporate policies, determining,

according to business rules, whatever the business wants to have as far as security goes.

That's what can now be programmed into these NGF DFW.

So it's thanks to the detailed analysis of data packets in these next generation firewalls.

There is no need to control the data packets in a second product.

Right.

Because this situation is recovered in terms of performance and cost.

Now, intrusion detection systems, IEDs.

Well, an idea is designed to analyze all packets looking for known events.

So when a known event is detected, a log message is generated detailing the event.

Ideas contains a database of known attack signatures and compares the incoming traffic with his signatures

in the database.

So if an attack is detected, the Ides reports the attack.

The primary function of an AIDS product is to alert you that suspicious activity is occurring, but

it's not going to prevent it.

The biggest challenges are they well, they generate a lot of false positives, right?

So take that with a grain of salt, maybe.

Now, eyepiece or intrusion prevention systems, so eyepiece is a device between the firewall and the

network device because it can stop suspicious traffic from going to the rest of the network, eyepiece

monitors, incoming packets and what they're actually using before deciding which packets enter the

network.

And IPS examines the content of the request, and depending on that, content can intercept, warn or

potentially clean up a malicious network request.

So identifying malicious package relies either on behavioral analysis or the use of signatures.

So the firewall, like I said before, is a rule based engine, but I.P.S also uses its own large database

for intrusion detection.

So an IPS evaluates a suspected attack and alerts the administrator when it occurs.

But EIPs also monitors for attacks originating from inside of his system.

Now, EIPs is not a replacement for a firewall or a good antivirus program, and IP should be considered

a tool to be used with your standard security products, such as antivirus and firewalls.

But you'll see how it increases your system specific or network wide security.

All right, my friend, so let's do a little bit of a recap because we've learned about firewalls,

unified threat management or UTMB next generation firewalls, NGF intrusion detection systems, idea

intrusion prevention systems, or IPS.

That's a lot.

And now, you know so much more.

So thanks for hanging in there.

Guess what?

We've got somewhere else to go in the next lesson.

So I'll see you then.