Security Architecture

Chapter 1

Security Architecture

Course: Comptia Securityx Cas 005
Subject: Comptia Securityx Cas 005 Practice Exam
Chapter: Security Architecture

To design or analyze an effective and secure network architecture, it is vital to consider a wide range of security services, tools, and best practices. The following sections provide detailed insights into critical network security services, their roles, and how they contribute to a secure network architecture.

1. Load Balancer

• Description: Distributes incoming network traffic across multiple servers, ensuring that no single server becomes a bottleneck.
• Security Objectives:

Availability: Maintains high availability by distributing traffic to avoid server overload. Resilience: Provides fault tolerance by redirecting traffic to healthy servers in case of failures.

• Availability: Maintains high availability by distributing traffic to avoid server overload.
• Resilience: Provides fault tolerance by redirecting traffic to healthy servers in case of failures.
• Real-Life Example: An e-commerce website employs a load balancer to handle a surge in online orders during holiday sales, preventing server crashes.

2. Intrusion Detection Systems (IDS), Network Intrusion Detection Systems (NIDS), and Wireless Intrusion Detection Systems (WIDS)

• Description: Monitors and analyzes network traffic to detect suspicious or malicious activity.
• Security Objectives:

Threat Detection: Identifies potential intrusions and generates alerts for security teams to investigate.

• Threat Detection: Identifies potential intrusions and generates alerts for security teams to investigate.
• Real-Life Example: A NIDS alerts administrators about unusual traffic patterns that might indicate a Distributed Denial of Service (DDoS) attack.
• Here’s a table that outlines the key differences and characteristics of Intrusion Detection Systems (IDS), Network Intrusion Detection Systems (NIDS), and Wireless Intrusion Detection Systems (WIDS):

Feature

IDS

NIDS

WIDS

Definition

A general system that monitors and analyzes events to detect security threats.

A specialized IDS that monitors network traffic to detect malicious activity.

A specialized IDS that monitors wireless networks for unauthorized devices and activities.

Scope

Can monitor host-level, application-level, and network-level activities.

Focuses on wired network traffic.

Focuses on wireless network traffic.

Primary Monitoring Target

Host-based or network-based events.

Packets traveling across wired networks.

Packets traveling across wireless networks (e.g., Wi-Fi).

Deployment Location

Depends on the type (host-based or network-based).

At key points in the wired network, such as near firewalls or switches.

Near wireless access points or within wireless coverage areas.

Threats Detected

General security incidents, including malware, privilege escalation, and system anomalies.

Network-specific threats such as unauthorized access, DDoS attacks, and traffic anomalies.

Wireless-specific threats such as rogue access points, unauthorized devices, and Wi-Fi attacks (e.g., deauthentication).

Traffic Visibility

May include network, system, and application data.

Monitors wired traffic only.

Monitors 802.11 wireless traffic.

Strengths

Versatile; applicable to different layers (host, application, network).

Strong for detecting wired network-based attacks and malicious activity.

Specialized for securing wireless environments and detecting wireless-specific threats.

Weaknesses

Limited to the type of IDS deployed (e.g., host-based IDS won't see network threats).

Cannot detect wireless-specific threats or rogue access points.

Limited to wireless traffic and cannot see threats on wired networks.

Examples of Usage

Host-based IDS monitoring log files; anomaly detection on endpoints.

Detecting port scans, packet anomalies, or unauthorized network connections.

Identifying unauthorized Wi-Fi networks, detecting man-in-the-middle attacks on wireless links.

Examples of Tools

Snort (HIDS), OSSEC, Tripwire.

Snort, Suricata, Zeek (formerly Bro).

AirSnare, Kismet, Cisco Wireless IDS.

3. Intrusion Prevention Systems (IPS), Network Intrusion Prevention Systems (NIPS), and Wireless Intrusion Prevention Systems (WIPS)

• Description: Detects and actively blocks malicious traffic or intrusions.
• Security Objectives:

Proactive Defense: Takes immediate action to block threats before they can cause harm.

• Proactive Defense: Takes immediate action to block threats before they can cause harm.
• Real-Life Example: An IPS blocks a known malware signature trying to infiltrate the network, preventing data compromise.
• Here’s a table outlining the key differences and characteristics of Intrusion Prevention Systems (IPS), Network Intrusion Prevention Systems (NIPS), and Wireless Intrusion Prevention Systems (WIPS):

Feature

IPS

NIPS

WIPS

Definition

A system that actively monitors and prevents identified security threats by taking automated action.

A specialized IPS that monitors and prevents malicious activity on wired networks.

A specialized IPS that monitors and prevents security threats in wireless networks.

Scope

Can operate at host-level, application-level, or network-level.

Focuses on wired network traffic.

Focuses on wireless network traffic and wireless access points.

Primary Monitoring Target

Host-based or network-based events, depending on deployment type.

Packets traveling across wired networks.

Packets and activities in wireless networks (e.g., Wi-Fi).

Deployment Location

Depends on type (host-based or network-based).

Inline with wired network infrastructure, such as routers or firewalls.

Near wireless access points or within the wireless coverage area.

Threats Detected and Prevented

General threats like malware, unauthorized access, and anomalies in host or network traffic.

Network-specific threats like DDoS attacks, unauthorized access attempts, and traffic anomalies.

Wireless-specific threats like rogue access points, unauthorized devices, and Wi-Fi attacks (e.g., deauthentication attacks).

Traffic Visibility

Varies depending on deployment; can include network, system, and application traffic.

Monitors and blocks wired network traffic.

Monitors and blocks 802.11 wireless traffic.

Action Taken

Can block, quarantine, or log malicious activity based on configured rules.

Blocks or mitigates malicious wired network activity.

Blocks wireless-specific threats like rogue APs, disallowed devices, and unauthorized connections.

Strengths

Versatile; applicable to different layers (host, application, network).

Strong for detecting and preventing wired network-based attacks.

Specialized for wireless environments, including rogue AP detection and protection.

Weaknesses

Dependent on deployment type; host-based systems cannot see network traffic.

Cannot address wireless-specific threats like rogue access points.

Limited to wireless environments and does not protect wired traffic.

Examples of Usage

Blocking malware on a host, mitigating an ongoing attack in a network.

Dropping malicious packets, blocking unauthorized access attempts.

Preventing unauthorized Wi-Fi connections, blocking rogue APs or wireless attacks.

Examples of Tools

Snort (IPS), Suricata (IPS).

Snort, Cisco Firepower, Palo Alto Networks (NIPS).

Cisco Wireless IPS, AirTight WIPS, Aruba WIPS.

4. Web Application Firewall (WAF)

• Description: Filters and monitors HTTP traffic to and from web applications.
• Security Objectives:

Application Security: Protects web applications from common threats like SQL injection and cross-site scripting (XSS).

• Application Security: Protects web applications from common threats like SQL injection and cross-site scripting (XSS).
• Real-Life Example: A WAF blocks malicious requests targeting an online banking platform, ensuring customer data remains secure.

5. Network Access Control (NAC)

• Description: Enforces security policies to control device access to the network.
• Security Objectives:

Access Control: Ensures only authorized and compliant devices connect to the network.

• Access Control: Ensures only authorized and compliant devices connect to the network.
• Real-Life Example: NAC prevents a device without up-to-date antivirus software from connecting to the corporate network.

6. Virtual Private Network (VPN)

• Description: Creates a secure, encrypted connection over a public network, such as the internet.
• Security Objectives:

Data Confidentiality: Protects data during transmission.

• Data Confidentiality: Protects data during transmission.
• Real-Life Example: Remote workers use VPNs to securely access company resources, protecting sensitive data from eavesdropping.

7. Domain Name System Security Extensions (DNSSEC)

• Description: Adds security to DNS queries by ensuring the authenticity and integrity of DNS responses.
• Security Objectives:

Data Integrity: Prevents DNS spoofing and cache poisoning attacks.

• Data Integrity: Prevents DNS spoofing and cache poisoning attacks.
• Real-Life Example: DNSSEC helps ensure that users accessing their bank’s website are not redirected to malicious sites.

8. Firewalls/Unified Threat Management (UTM)/Next-Generation Firewalls (NGFW)

• Description: Controls incoming and outgoing network traffic through security policies and rules.
• Security Objectives:

Traffic Filtering: Blocks unauthorized access and detects threats.

• Traffic Filtering: Blocks unauthorized access and detects threats.
• Real-Life Example: An NGFW inspects traffic for malware and blocks it before it enters the internal network.
• Here's a comparative table that outlines the key differences and characteristics of Firewalls, Unified Threat Management (UTM), and Next-Generation Firewalls (NGFW):

Feature

Firewalls

Unified Threat Management (UTM)

Next-Generation Firewalls (NGFW)

Definition

A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.

An all-in-one security solution combining multiple security features, including firewall capabilities.

An advanced type of firewall with integrated application-level filtering, intrusion prevention, and other advanced features.

Primary Function

Filters traffic based on IP addresses, ports, and protocols.

Combines traditional firewall functions with additional features like antivirus, intrusion detection, and content filtering.

Includes traditional firewall features and advanced capabilities like deep packet inspection (DPI), application awareness, and threat intelligence.

Scope

Basic perimeter defense.

Comprehensive, multi-layered defense suitable for small to medium-sized organizations.

Advanced threat prevention and application-specific controls for modern, complex networks.

Features

• Packet filtering - Stateful inspection - Network Address Translation (NAT)

• Packet filtering - Stateful inspection - Intrusion detection/prevention - Antivirus - Web filtering - VPN

• Packet filtering - Stateful inspection - Deep packet inspection - Application control - Intrusion prevention - Threat intelligence - SSL decryption

Traffic Inspection Depth

Inspects traffic at the network level.

Inspects traffic at the network level and includes some application-level inspection.

Inspects traffic deeply at the application level, understanding specific applications and protocols.

Use Cases

• Basic traffic filtering - Network segmentation - Small, less complex networks

• Consolidated network protection - Small and medium-sized businesses - Cost-effective solution

• Advanced threat detection - Large or complex networks - Organizations requiring high security against modern threats

Management Complexity

Simple to configure and manage.

Moderate complexity due to the variety of integrated tools.

Higher complexity due to advanced features and granular controls.

Strengths

• Simple, reliable - Low cost - Low resource usage

• Comprehensive security - Cost-effective for smaller organizations - Integrated tools reduce the need for multiple devices

• Granular control - Effective against advanced threats - Suitable for complex environments

Weaknesses

• Limited to basic filtering - Cannot analyze application-level traffic - Does not include advanced threat protection

• May lack advanced features needed for large enterprises - Performance can degrade with too many active features

• More expensive - Requires skilled personnel for configuration and management

Examples

Cisco ASA, pfSense, Juniper SRX

Fortinet FortiGate (UTM), Sophos XG UTM

Palo Alto Networks, Cisco Firepower, Check Point NGFW

9. Network Address Translation (NAT) Gateway

• Description: Translates private IP addresses to public IP addresses and vice versa.
• Security Objectives:

Network Isolation: Hides internal IP addresses, making it harder for external attackers to target devices.

• Network Isolation: Hides internal IP addresses, making it harder for external attackers to target devices.
• Real-Life Example: NAT gateways are used to provide internet access to devices in private subnets without exposing their IP addresses.

10. Internet Gateway

• Description: Connects a private network to the internet while controlling traffic flow.
• Security Objectives:

Controlled Connectivity: Manages outbound and inbound traffic for secure communication.

• Controlled Connectivity: Manages outbound and inbound traffic for secure communication.

11. Forward/Transparent Proxy and Reverse Proxy

• Forward Proxy: Acts on behalf of clients, masking their identity while making requests.
• Reverse Proxy: Acts on behalf of servers, managing incoming requests and load balancing.
• Security Objectives:

Anonymity and Security: Protects client and server identities and can filter malicious traffic.

• Anonymity and Security: Protects client and server identities and can filter malicious traffic.
• Real-Life Example: A reverse proxy for a website manages HTTPS termination, improving security and performance.
• Here’s a comparative table that highlights the key differences between Forward Proxy, Transparent Proxy, and Reverse Proxy:

Feature

Forward Proxy

Transparent Proxy

Reverse Proxy

Definition

Acts as an intermediary between clients and external servers, forwarding client requests to the target server.

A subtype of forward proxy that operates without requiring client configuration or awareness.

Acts as an intermediary between external clients and internal servers, forwarding client requests to the appropriate server.

Primary Purpose

• Anonymize client identity - Filter or control outbound client traffic - Cache content for clients

• Enforce policies or caching for clients - Seamless to end users

• Load balancing - Distribute incoming traffic to multiple servers - Provide an extra layer of security for servers

Direction of Traffic

Client → Proxy → Server

Client → Proxy → Server

Client → Proxy → Server (internal)

Client Awareness

Requires client configuration to use the proxy (e.g., proxy settings in the browser or OS).

Does not require client configuration; intercepts traffic transparently.

Clients are unaware of the proxy; they interact with it as if it were the actual server.

Caching

Often caches responses from servers for quicker client access.

Similar to forward proxy but seamless to the user.

May cache server responses to improve performance for external clients.

Security Features

• Filters outgoing traffic - Masks client IP addresses - Restricts access to certain websites or content

Similar to forward proxy but transparently applies security and filtering.

• Masks internal server details - Protects servers from direct exposure to external threats

Typical Use Cases

• Providing internet access through a controlled gateway - Content filtering (e.g., schools, workplaces) - Logging and monitoring client activity

• Seamless content filtering (e.g., parental controls, ISP-level filtering) - Reducing latency for frequently accessed resources

• Load balancing - Hiding internal server details - Securing and managing external requests to internal services

Examples of Tools

Squid, Privoxy, Blue Coat ProxySG

Squid (configured as a transparent proxy), Websense

NGINX, HAProxy, Apache Traffic Server

12. Distributed Denial-of-Service (DDoS) Protection

• Description: Protects against attacks that overwhelm network resources.
• Security Objectives:

Availability: Maintains uptime by absorbing and mitigating attack traffic.

• Availability: Maintains uptime by absorbing and mitigating attack traffic.
• Real-Life Example: A DDoS protection service prevents downtime during an attack on a popular streaming service.

13. Routers

• Description: Directs data packets between networks, based on routing policies.
• Security Objectives:

Traffic Control: Ensures secure and efficient routing of data.

• Traffic Control: Ensures secure and efficient routing of data.
• Real-Life Example: Routers configured with access control lists (ACLs) to block malicious traffic.

14. Mail Security

• Description: Filters and protects email communications.
• Security Objectives:

Spam and Phishing Protection: Blocks malicious emails.

• Spam and Phishing Protection: Blocks malicious emails.
• Real-Life Example: Mail security solutions prevent phishing attacks by blocking emails with suspicious links.

15. API Gateway/Extensible Markup Language (XML) Gateway

• Description: Manages API traffic, providing security and load balancing for APIs.
• Security Objectives:

API Security: Protects against API abuse and ensures secure communication.

• API Security: Protects against API abuse and ensures secure communication.
• Real-Life Example: An API gateway blocks unauthorized API calls that attempt to access sensitive data.
• Here’s a comparative table that outlines the key differences and characteristics of API Gateway and Extensible Markup Language (XML) Gateway:

Feature

API Gateway

XML Gateway

Definition

A gateway that manages, secures, and facilitates communication between clients and APIs.

A gateway that specifically processes and secures XML-based messages in SOA (Service-Oriented Architecture).

Primary Purpose

• Centralizes API management - Handles RESTful and other modern API protocols.

• Processes, validates, and secures XML messages - Facilitates SOAP-based web services.

Supported Protocols

REST, GraphQL, WebSocket, gRPC, SOAP, HTTP, HTTPS

SOAP, HTTP, HTTPS

Traffic Handling

• Routes API requests - Manages API traffic, throttling, and load balancing.

• Parses and validates XML traffic - Transforms XML messages between different formats.

Security Features

• API key validation - OAuth/OpenID Connect support - Rate limiting - SSL/TLS encryption

• XML schema validation - WS-Security - Encryption and signing of XML messages

Transformation Capabilities

• Translates requests between different API formats (e.g., REST to SOAP).

• Transforms XML messages between schemas - Converts XML to JSON or vice versa.

Use Cases

• Managing APIs for microservices - Centralized API monitoring and analytics - Enabling API monetization

• Ensuring secure communication between SOAP-based web services - Enabling legacy system integration in SOA.

Client Awareness

Clients interact with APIs via the gateway, often aware of the API endpoint.

Clients interact with XML/SOAP services, typically unaware of the gateway.

Key Features

• API discovery and documentation - Authentication and authorization - Request and response transformation - Analytics and monitoring

• XML schema enforcement - Message-level encryption and signing - XML-specific threat protection (e.g., against XXE attacks).

Typical Deployment

• Microservices architectures - Cloud-native applications - Modern web and mobile APIs

• Legacy systems - Enterprises using SOA and SOAP-based web services

Examples of Tools

AWS API Gateway, Kong, Apigee, MuleSoft API Manager

IBM DataPower Gateway, Axway API Gateway, CA API Gateway

16. Traffic Mirroring, SPAN Ports, Port Mirroring, Network Tap

• Description: Copies network traffic for analysis or security monitoring.
• Security Objectives:

Visibility: Enhances security monitoring and troubleshooting.

• Visibility: Enhances security monitoring and troubleshooting.
• Real-Life Example: SPAN ports are used to forward traffic to IDS devices for threat detection.
• Traffic mirroring and associated techniques, such as SPAN ports, port mirroring, Virtual Private Cloud (VPC), and network taps, play critical roles in ensuring network security, monitoring, and analysis. Here's a detailed overview of each concept, its security objectives, use cases, and real-world examples.

1. Traffic Mirroring Description:

• Traffic mirroring is a process where a copy of network traffic (packets) is replicated and sent to a monitoring device or security tool. It allows for detailed analysis of network behavior, threat detection, performance assessment, and more.
• Security Objectives:
• Visibility: Provides real-time visibility into network traffic for security monitoring.
• Threat Detection and Forensics: Assists in detecting intrusions, analyzing security incidents, and conducting forensic investigations.
• Performance Monitoring: Identifies performance bottlenecks and issues by capturing real-time data flows.
• Real-Life Example:
• In a corporate network, traffic mirroring can be used to replicate traffic from critical servers to an Intrusion Detection System (IDS) for continuous threat monitoring and analysis.
• 2. Switched Port Analyzer (SPAN) Ports Description:
• SPAN Ports, often referred to as port mirroring ports on a switch, enable network administrators to replicate traffic from one or more ports to a designated monitoring port. It’s commonly used for sending mirrored traffic to network monitoring or analysis devices.
• Security Objectives:
• Monitoring Specific Traffic: Focuses on capturing traffic from specific network segments or interfaces.
• Compliance and Auditing: Facilitates network monitoring for compliance requirements by allowing detailed inspections of specific data flows.
• Real-Life Example:
• An organization uses SPAN ports to mirror traffic from its DMZ servers to a security appliance for in-depth analysis without disrupting normal network functions.
• 3. Port Mirroring Description:
• Port mirroring is the process of duplicating packets seen on one network port (or an entire VLAN) to another port on a network switch. This allows network administrators to monitor network traffic in real time.
• Security Objectives:
• Traffic Analysis: Provides in-depth inspection of network data for troubleshooting, performance analysis, and security monitoring.
• Data Integrity: Helps in identifying and addressing network threats such as data exfiltration or policy violations.
• Real-Life Example:
• A network engineer configures port mirroring on a switch to monitor traffic destined for a database server, identifying any unusual or unauthorized access attempts.
• 4. Virtual Private Cloud (VPC) Description:
• A Virtual Private Cloud (VPC) is a private cloud environment within a public cloud infrastructure. It provides logically isolated network segments for resources and allows users to define custom network configurations.
• Security Objectives:
• Isolation: Ensures data and resources are isolated from other tenants in the cloud.
• Granular Access Control: Provides control over IP address ranges, route tables, network gateways, and security policies.
• Real-Life Example:
• A company hosts its customer database within a VPC in AWS, using security groups and network access control lists (ACLs) to enforce strict access policies.
• 5. Network Tap Description:
• A Network Tap (Terminal Access Point) is a hardware device that copies traffic passing through a network segment for monitoring and analysis. Unlike SPAN ports, network taps operate independently of the network switch and do not affect its performance.
• Security Objectives:
• Passive Monitoring: Allows for unobtrusive traffic monitoring without introducing latency or affecting network performance.
• Security Tool Integration: Often used to provide a clean copy of network traffic to IDS/IPS systems, packet analyzers, or security appliances.
• Real-Life Example:
• A financial institution installs network taps at critical points in its infrastructure to feed raw traffic data to a Security Information and Event Management (SIEM) system for comprehensive threat detection and logging.
• Real-Life Scenarios and Use Cases
• Scenario: A large enterprise sets up SPAN ports and network taps to monitor critical network segments for unauthorized data exfiltration attempts. Mirrored traffic is analyzed by a dedicated security team using SIEM tools.
• Example: An e-commerce business configures a VPC with stringent security groups to isolate its payment systems from the rest of its environment, ensuring PCI-DSS compliance.
• Images for Context
• • Illustrating how network taps operate.
• • Shows VPC configuration and components.

17. Sensors (SIEM, FIM, SNMP Traps, NetFlow, DLP, Antivirus)

• Security Information and Event Management (SIEM): Collects and analyzes security data in real-time.
• File Integrity Monitoring (FIM): Detects unauthorized changes to files.
• Data Loss Prevention (DLP): Prevents sensitive data leaks.
• Antivirus: Detects and removes malware.
• The integration of sensors, monitoring systems, and specialized security tools is essential to maintaining the security and performance of a network. These tools offer visibility, detection, and protection capabilities, which help organizations to identify, analyze, and mitigate potential threats in real-time. The following sections provide detailed explanations of key security tools and their importance in network security.

1. Sensors Description:

• Sensors are devices or software components that collect data from various points in a network for security monitoring and analysis.
• Types of Sensors: Network sensors, endpoint sensors, application sensors, etc.
• Security Objectives:
• Data Collection: Gather real-time data on network traffic, system activities, and user behavior.
• Threat Detection: Detect anomalies and potential security incidents.
• Real-Life Example:
• An organization deploys network sensors at key locations to monitor traffic and alert the security team when unusual activity, such as data exfiltration attempts, is detected.
• 2. Security Information and Event Management (SIEM) Description:
• SIEM systems collect, correlate, and analyze security data from across the network to provide a comprehensive view of security incidents.
• Key Features: Real-time monitoring, threat detection, event correlation, and incident response automation.
• Security Objectives:
• Centralized Monitoring: Provides a single view of security logs and events from different sources.
• Threat Intelligence: Correlates data from multiple sources to detect complex attack patterns.
• Compliance: Helps organizations meet regulatory requirements by providing detailed logging and reporting capabilities.
• Real-Life Example:
• A company uses a SIEM solution to aggregate logs from firewalls, intrusion detection systems, and endpoints. When an abnormal login pattern is detected, the SIEM triggers an alert, allowing for a rapid response.
• 3. File Integrity Monitoring (FIM) Description:
• FIM tools monitor files for unauthorized changes, such as modifications, deletions, or additions. FIM is commonly used to ensure the integrity of critical system and application files.
• Security Objectives:
• Data Integrity: Ensures that critical files remain unaltered unless authorized changes are made.
• Compliance: Meets compliance standards like PCI DSS, which require file monitoring.
• Real-Life Example:
• A retail company uses FIM to monitor changes to files on its point-of-sale (POS) systems to detect and respond to unauthorized modifications.
• 4. Simple Network Management Protocol (SNMP) Traps Description:
• SNMP traps are alerts sent from a network device (such as routers, switches, or servers) to a central monitoring system when a specific event occurs.
• Security Objectives:
• Real-Time Alerts: Provides timely notifications about critical issues such as device failures, configuration changes, or network congestion.
• Network Health Monitoring: Helps administrators maintain the health and performance of network devices.
• Real-Life Example:
• An SNMP trap is triggered when a network switch exceeds its CPU usage threshold, alerting the IT team to investigate the issue.
• 5. NetFlow Description:
• NetFlow is a network protocol developed by Cisco for collecting and analyzing IP traffic data. It provides visibility into network traffic patterns, identifying the "who," "what," "where," and "when" of network activities.
• Security Objectives:
• Traffic Analysis: Offers detailed insights into network traffic flows, helping detect anomalies and potential security threats.
• Network Performance Optimization: Identifies bottlenecks and enables capacity planning.
• Real-Life Example:
• A network administrator uses NetFlow data to analyze spikes in traffic from a specific IP address, identifying potential Distributed Denial-of-Service (DDoS) activity.
• 6. Data Loss Prevention (DLP) Description:
• DLP solutions prevent sensitive data from being accidentally or maliciously shared, leaked, or exfiltrated. They enforce data security policies on endpoints, networks, and cloud applications.
• Security Objectives:
• Data Security: Protects sensitive data such as customer information, intellectual property, and financial records.
• Policy Enforcement: Ensures compliance with data protection regulations.
• Real-Life Example:
• A company deploys a DLP solution to monitor email communications, preventing employees from sending confidential files outside the organization without proper authorization.
• 7. Antivirus Description:
• Antivirus software detects, quarantines, and removes malicious software, including viruses, trojans, worms, and spyware, from endpoints such as computers and servers.
• Security Objectives:
• Malware Detection and Removal: Identifies and eliminates known malware.
• Endpoint Protection: Provides an additional layer of security for endpoints.
• Real-Life Example:
• An antivirus solution detects and removes a trojan horse that was embedded in an email attachment, preventing it from spreading within the organization’s network.
• Real-Life Scenarios and Use Cases
• Scenario: A financial institution deploys a SIEM system to monitor security events from various endpoints, enabling rapid detection and response to unauthorized access attempts.
• Example: An enterprise uses FIM to monitor changes to its critical system files, preventing unauthorized tampering by malware or insider threats.