In this section we are going to take a look to the next generation firewalls and the IP guys firewalls
are as standard security tool for the majority of companies.
But in today's changing threat landscape next generation firewalls are the only firewalls that can provide
proper protection.
The former firewalls were just able to perform some protocol inspections and port inspections.
But these did pack inspection firewalls are moving beyond Port protocol inspection and blocking to add
the application level inspection intrusion probation and bragging bringing intelligence from outside
the firewall so as the name suggests next generation firewalls are a more advanced version of the traditional
firewall and they offer some benefits.
But next generation firewall has some advanced features like regular firewalls next generation firewall
use both static and dynamic packet filtering and weeping and support to ensure that all connections
between the network internet and firewall are valid and secure both firewall types should also be able
to translate to network and port addresses in order to map eyepiece.
There are also fundamental differences between the traditional firewall and next generation firewalls.
The most obvious difference between the two is next generation firewalls ability to filter packets based
on application skies.
These firewalls have extensive control and visibility of applications that is able to identify using
analysis and signature matching.
So that means for example a if you want to block Skype in a network or if you want to block Facebook
in a network or any other application you can do it with the next generation firewall which is not possible
to do it with a traditional firewall.
And also they can use swipe lists or a signature based IP as to distinguish between safe applications
and unwanted ones which are then identified using SSL decryption.
Unlike most traditional firewalls next generation firewalls also include a path through which feature
updates will be received.
And let's go ahead with the benefits of next generation firewalls and next generation firewall performs
traditional firewall features like state for firewall filtering net and VPN termination.
And it's also providing us application visibility and control.
This feature looks deep into the application layer data to identify the application.
For instance it can identify the application based on the data rather than put number to defend against
attacks that use random port numbers.
Next Generation firewall also provide advanced malware protection guys and GSW platforms through multiple
security services not just as a platform to run a separate service but for better integration of functions
and network based anti malware function can run on the firewall itself blocking the files files transfers
that will install malware and saving copies of files for later analytics.
Also next generation firewalls can provide you are L filtering this feature exam mines.
There you are.
Else in each rep request categorizes the URLs and either filters or rape limits the traffic based on
rules.
Also next generation firewalls can run their NGO IP as next generation IP as feature along with their
firewall.
Let's talk about the IP as intrusion prevention system also an IP address is a network security threat
prevention technology that Exim minds the network traffic flows to detect and prevent vulnerability
exploits while durability exploits usually come in the form of malicious inputs to a target application
or service that attackers use to interrupt and gain control of an application or mission following a
successful exploit the attacker can disable the target application or can potentially access to all
the rights and permissions available for the compromised the application the IP is guys often sits directly
behind the firewall and provides a complementary layer of analyses that negatively selects for the dangerous
content and also I need to tell this one a IP as is not as separate hardware in today's networks and
most of are integrated the fire was so unlike its predecessor the intrusion detection system idea as
which is a passive system that scans traffic and reports back on threats.
The eyepiece is placed to inline actively analyzing and taking automated actions on all traffic flows
that enter the network.
Specifically these actions include like sending an alarm to administrator dropping the malicious packets
blocking traffic from the source address and resetting the connection as an inline security component.
The IP is must work efficiently to avoid degrading network performance.
It must also work fast because exploits can happen in near real time.
The IP address must also detect and respond accurately so as to eliminate threats and false positives
and the IP as guys has a number of detection methods for finding exploits.
But signature based detection and statistical anomaly based detection are the two dominant mechanisms
signature based detection is based on a dictionary of uniquely identifying patterns or signatures in
the code of each exploit as an exploit is discovered.
It is signature is recorded and stored in a continuously growing dictionary of signatures.
Signature detection for IP is breaks down into two types.
First exploit facing signatures.
Identify individual exploits by triggering on the unique patterns of a particular exploit attempt.
The IP address can identify specific exploits by finding a match with an exploit facing signature in
the traffic stream.
And second while liability facing signatures are broader signatures that target the underlying vulnerability
in the system that is being targeted.
These signatures allow the networks to be protected from variants of an exploit that may not have been
directly observed in the wild but also raise the risk of false positives and also IP as can provide
statistical anomaly detection.
Statistical anomaly detection takes samples of network traffic at random and compares them to a pretty
calculated baseline performance level.
That is a really really cool feature.
Guys when the sample of network traffic activity is outside the parameters of baseline performance the
eyepiece takes action to handle the situation.