Protecting and Port Scanning

Chapter 4: Protecting the Organization
This chapter covers some of the technology and processes used by cyber security professionals
when protecting an organization’s network, equipment and data.
First, it briefly covers the many types of firewalls, security appliances, and software that are
currently used, including best practices.
Next, this chapter explains botnets, the kill chain, behavior-based security, and using Net Flow
to monitor a network.
The third section discusses Cisco’s approach to cyber security, including the CSIRT team and
the security playbook. It briefly covers the tools that cyber security professionals use to detect
and prevent network attacks.
Firewall Types
A firewall is a wall or partition that is designed to prevent fire from spreading from one part of a
building to another.
In computer networking, a firewall is designed to control, or filter, which communications are

allowed in and which are allowed out of a device or network, as shown in the figure.
A firewall can be installed on a single computer with the purpose of protecting that one
computer (host-based firewall), or it can be a stand-alone network device that protects an
entire network of computers and all of the host devices on that network (network-based
firewall).
Over the years, as computer and network attacks have become more sophisticated, new types
of firewalls have been developed which serve different purposes in protecting a network. Here
is a list of common firewall types:
 Network Layer Firewall – filtering based on source and destination IP addressesz
 Transport Layer Firewall –filtering based on source and destination data ports, and
filtering based on connection states
 Application Layer Firewall –filtering based on application, program or service
 Context Aware Application Firewall – filtering based on the user, device, role, application
type, and threat profile
 Proxy Server – filtering of web content requests like URL, domain, media, etc.
 Reverse Proxy Server – placed in front of web servers, reverse proxy servers protect,
hide, offload, and distribute access to web servers
 Network Address Translation (NAT) Firewall – hides or masquerades the private

addresses of network hosts
 Host-based Firewall – filtering of ports and system service calls on a single computer
operating system
Port Scanning
Port-scanning is a process of probing a computer, server or other network host for open
ports.
In networking, each application running on a device is assigned an identifier called a port

number. This port number is used on both ends of the transmission so that the right data is
passed to the correct application. Port-scanning can be used maliciously as a reconnaissance
tool to identify the operating system and services running on a computer or host, or it can be
used harmlessly by a network administrator to verify network security policies on the network.
For the purposes of evaluating your own computer network’s firewall and port security, you
can use a port-scanning tool like Nmap to find all the open ports on your network. Port-
scanning can be seen as a precursor to a network attack and therefore should not be done on
public servers on the Internet, or on a company network without permission.
To execute an Nmap port-scan of a computer on your local home network, download and
launch a program such as Zenmap, provide the target IP address of the computer you would
like to scan, choose a default scanning profile, and press scan. The Nmap scan will report any
services that are running (e.g., web services, mail services, etc.) and port numbers. The
scanning of a port generally results in one of three responses:
 Open or Accepted – The host replied indicating a service is listening on the port.
 Closed, Denied, or Not Listening – The host replied indicating that connections will be
denied to the port.
 Filtered, Dropped, or Blocked – There was no reply from the host.
To execute a port-scan of your network from outside of the network, you will need to initiate
the scan from outside of the network. This will involve running an Nmap port-scan against
your firewall or router’s public IP address. To discover your public IP address, use a search
engine such as Google with the query “what is my ip address”. The search engine will return
your public IP address.
To run a port-scan for six common ports against your home router or firewall, go to the Nmap
Online Port Scanner at https://hackertarget.com/nmap-online-port-scanner/ and enter your
public IP address in the input box: IP address to scan… and press Quick Nmap Scan.
If the response is open for any of the ports: 21, 22, 25, 80, 443, or 3389 then most likely, port
forwarding has been enabled on your router or firewall, and you are running servers on your
private network, as shown in the figure.

Protecting and Port Scanning

Uploaded by

Copyright:

Available Formats

Protecting and Port Scanning

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Protecting and Port Scanning

Uploaded by

Copyright:

Available Formats

Chapter 4: Protecting the Organization

In computer networking, a firewall is designed to control, or filter, which communications are

 Application Layer Firewall –filtering based on application, program or service

 Network Address Translation (NAT) Firewall – hides or masquerades the private

In networking, each application running on a device is assigned an identifier called a port

 Filtered, Dropped, or Blocked – There was no reply from the host.

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.