Lesson 10 Implementing Network Security Appliances

Vocabulary flashcards covering firewalls, proxies, NAT, IDS/IPS, NGFW/UTM, content filters, WAFs, SIEM, and related monitoring concepts from the lecture notes.

Firewall

A security device or software that enforces network access controls by filtering traffic according to rules, protocols, ports, and addresses.

ACL (Access Control List)

A set of rules used by firewalls to accept or deny traffic based on packet characteristics (IP, port, protocol).

Packet Filtering Firewall

An early firewall type that inspects IP headers and applies ACLs, typically stateless.

Stateless

A firewall mode that does not retain session state between packets; analyzes each packet independently.

Stateful Inspection

A firewall technique that tracks active connections in a state table and validates new packets against it.

State Table

A data table that stores information about current connections for stateful inspection.

Transport Layer (OSI Layer 4)

Layer that handles TCP/UDP; where some firewall checks (e.g., handshake) occur.

Application Layer Firewall (Layer 7)

A firewall that inspects application payload and protocols; may perform deep packet inspection.

Application-Aware Firewall

A firewall that recognizes specific applications and enforces policies accordingly.

iptables

Linux command-line utility to manage kernel firewall rules via chains and policies.

Firewall Appliance

Standalone hardware device deployed to monitor and filter traffic at network edges.

Routed Firewall (Layer 3)

Firewall that forwards traffic between subnets; interfaces connect to different security zones.

Bridged Firewall (Layer 2)

Firewall operating as a bridge; inspects traffic without acting as a router.

Transparent Firewall

Bridged firewall with no data-path IP interface; manages traffic without subnet reconfiguration.

Host-Based Firewall

Software firewall on a single host protecting that host and its network access.

Application Firewall

Software firewall protecting a specific application (e.g., a web server) on a server.

NOS Firewall

Software firewall running on a network OS (Windows/Linux) acting as gateway or proxy.

Proxy

Intermediary that filters and forwards traffic by deconstructing and rebuilding packets at the application layer.

Forward Proxy

Proxy that handles outbound client requests (e.g., web access) and may reside in a DMZ.

Non-Transparent Proxy

Proxy requiring clients to be configured with its address and port.

Transparent Proxy

Proxy that intercepts traffic without client configuration; inline with the network.

PAC (Proxy Auto-Config)

Script that configures proxy settings automatically on clients.

WPAD (Web Proxy Auto-Discovery)

Protocol that helps browsers locate a PAC file; potential attack vector if misused.

Reverse Proxy

Proxy at the network edge that handles inbound requests for internal servers, often with load balancing and encryption.

NAT (Network Address Translation)

Translates private IP addresses to public addresses at the network edge; not a filtering function by itself.

RFC 1918 Private Address Ranges

Reserved private IP ranges for internal networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

Static NAT

One-to-one mapping between an inside local and an inside global address.

Dynamic NAT

NAT using a pool of public addresses to map multiple inside addresses dynamically.

NAPT/PAT (Port Address Translation)

Overloads many private addresses onto a single public address using port mappings.

Destination NAT / Port Forwarding

Forwards incoming traffic to a designated internal host and port.

NAT66 / NAT64 / NPTv6

IPv6/IPv4 translation mechanisms for cross-architecture address handling (IPv6-to-IPv6, IPv6-to-IPv4, and prefix translation).

NAT Overload

NAPT; multiple private addresses share a single public IP via port numbers.

Virtual Firewalls

Firewalls deployed in virtual environments (hypervisor-based, virtual appliance, or multiple contexts).

NGFW (Next-Generation Firewall)

Firewall that combines application awareness, user filtering, and often IPS; may include cloud inspection.

UTM (Unified Threat Management)

Single appliance centralizing firewall, anti-malware, IPS, content filtering, DLP, VPN, etc.; potential single point of failure.

Content Filter / SWG

Filter that controls user web access (block URLs, time-based rules) and often includes threat analysis.

WAF (Web Application Firewall)

Firewall focused on protecting web applications from code injection and DoS; uses signatures and pattern matching.

HIDS (Host-Based IDS)

IDS that monitors a single host's logs, files, and processes; may include FIM (File Integrity Monitoring).

NIDS (Network-Based IDS)

IDS with sensors on the network to monitor traffic for attack signatures; passive by default.

IPS (Intrusion Prevention System)

Inline IDS that can terminate or throttle offending traffic and block attacks.

Inline Deployment

Deployment where traffic passes through the security device, enabling active blocking.

SIEM (Security Information and Event Management)

Platform that aggregates logs and events from many sources, correlates them, and provides alerts and dashboards.

UEBA (User and Entity Behavior Analytics)

SIEM capability that analyzes user and machine behavior to detect anomalies.

NBAD (Network Behavior Anomaly Detection)

ML-based detection of anomalous network traffic patterns; often integrated with SIEM.

NTA (Network Traffic Analysis)

Analysis of network streams for anomalies, similar to IDS but focused on traffic.

SOAR (Security Orchestration, Automation, and Response)

Automation layer that coordinates incident response workflows with SIEM.

Snort / Suricata / Zeek

Popular network-based IDS tools used for signature-based detection.

SPAN / Mirror Port

Switch feature that copies frames to a sensor; may drop frames under load.

TAP (Test Access Point)

Physical device to copy network traffic for monitoring; comes in passive or active forms.

ModSecurity

Open-source WAF for Apache, nginx, and IIS; supports rule sets and signatures.

NAXSI

Open-source WAF module for nginx.

Imperva

Commercial WAF and security suite (e.g., SecureSphere) focusing on web security.

Regex (Regular Expressions)

Pattern-based language used to search/log data and parse text in logs.

grep

Unix command to search text files for patterns; supports exact or regex matching.

Syslog

Standardized protocol for centralized logging used by many devices and SIEMs.