1. a. Are internal security threats more dangerous than external security threat
ID: 3573624 • Letter: 1
Question
1. a. Are internal security threats more dangerous than external security threats? Why?
b. Under what conditions should you consider implementing a honeypot? Under what conditions should you not operate a honeypot?
c. What would be the advantages and disadvantages of a hybrid Intrusion Detection System which uses both anomaly-based and signature-based detection methods?
d. Compare and contrast four different types of firewalls.
e. Can a firewall with DPI capabilities protect a network against DDoS attacks? Justify your answer.
Explanation / Answer
1. a) Internal security threats are more dangeorous than external security threats because the inside data can be able to access by the workers that who are working inside whereas when we go for the outside security threats can be addressed with some traditional security measures. The most difficult threat that is very tough to find out and prevent it is from the threat which comes from inside because this will have for the intentive purpose for some advantages individually.
b. In most of the cases Honeypots are implemented for the purpose of tracking the spam and worm propogation. It helps to detect the unknown worm while it is collecting or inserting the data. Honeypots are not implemented in the case where you are not able to control the outgoing packets. It shows a serious vulnerability to the network.
c. The main advantage in hybris intruction detection system is combining all the different HIDS can make good technology that result in good output but the drawback is keeping all these in one system is a big task.
d. Let us discuss the different types of firewalls
1. Packet filtering firewall which is used for the operation of the router which recieves the packets.and make comparision between each packets.
2. stateful inspection firewalls which is used to examine the each packet and keep on tracking about the packets weather it is belongs to the particulat TCP or not
3. multi level inception firewalls which is used to monitor the circuits that are build together and and make direct connections between the local and remote host.
4. Application level gateway firewalls which is used for the filtering of the packets to which they are allocated to do for actually.
e. DDoS attacks has become one of the boostup term for the those who tend to hacking and cyber criminals. I dont think so firewall can do it because attackers are coming up with different techniques including slow and low attack techniques and ssl based attacks.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.