Hands-On Ethical Hacking and Network Defense, Third Edition 13-1
Chapter 13
Network Protection Systems
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
• Quick Quizzes
Hands-On Ethical Hacking and Network Defense, Third Edition 13-2
Lecture Notes
Overview
This chapter describes several network protection systems that security professionals and
network administrators can use to better protect their networks. Students will learn about
firewall technologies and how they can contribute to make a network safer. Students will also
learn about intrusion detection systems and intrusion prevention systems and their role in
network defense. Finally, the chapter introduces the concept of honeypots and explains how
they can be used to better understand the techniques of hackers.
Chapter Objectives
After reading this chapter and completing the exercises, the student will be able to:
• Explain how routers are used as network protection systems
• Describe firewall technology and tools for configuring firewalls and routers
• Describe intrusion detection and prevention systems and Web-filtering technology
• Explain the purpose of honeypots
Teaching Tips
Understanding Network Protection Systems
2. Describe a Unified Threat Management (UTM) device as a single device that combines
many network protection functions as those performed by:
3. Explain that the term security appliance can be used to describe both UTMs and
Understanding Routers
1. Define routers as hardware devices used on a network to send packets to different
network segments.
2. Explain the routing protocols used by routers in a best-path decision-making process.
Understanding Basic Hardware Routers
1. Review some of the vulnerability information released by Cisco about its products as an
example of the issues security professionals work with.
Teaching
Tip
Read these articles from SecurityFocus about exploiting Cisco routers available
at http://www.securityfocus.com/infocus/1734 and
http://www.securityfocus.com/infocus/1749.
Cisco Router Components
1. Explain the components used by a Cisco router.
a. Random access memory (RAM)
Cisco Router Configuration
1. Explain the user mode configuration mode.
3. Explain the global configuration mode.
5. Using Table 13-1, describe some of the commands available on Cisco routers and their
Understanding Access Control Lists
1. Define IP access lists as lists of IP addresses, subnets, or networks that are allowed or
denied access through a router’s interface.
2. Describe both types of access lists.
a. Standard IP access lists
b. Extended IP access lists
Hands-On Ethical Hacking and Network Defense, Third Edition 13-4
Teaching
Tip
Check out http://www.certiology.com/cisco-certifications/ccna/ccna-routing-and-
switching/free-cisco-ccna-study-guide/access-lists.html for more information about
standard IP and extended IP access lists.
Standard IP Access Lists
1. Explain that standard IP access lists can restrict IP traffic entering or leaving a router’s
Extended IP Access Lists
1. Explain that extended IP access lists can restrict IP traffic entering or leaving a router’s
interface based on:
a. Source IP address
Quick Quiz 1
1. Which devices operate at the Network layer of the TCP/IP protocol stack and are used
on a network to send packets to different network segments?
A. security appliances
B. web-filtering systems
C. VPNs
D. routers
2. True or False: If a router is using a distance-vector routing protocol, it uses link-state
advertisements sent to other routers that identify the network topology and any changes
or paths that have recently been discovered on the network.
3. Which component of a Cisco router holds the router’s configuration file, but the
information is not lost if the router is turned off?
A. Flash memory
B. Nonvolatile RAM
C. Random access memory
D. Read-only memory
4. When configuring a router, the router name followed by a greater-than sign (>), such as
Router>, indicates that you’re in which mode?
A. user
B. global configuration
C. privileged
D. interface configuration
5. Standard IP access lists can restrict IP traffic entering or leaving a router’s interface
based on which of the following?
A. Destination IP address
B. Application port number
C. Source IP address
D. Protocol type
Understanding Firewalls
1. Define firewalls as hardware devices or software installed on a system having two
2. Explain the advantages and disadvantages of hardware-based and software-based
Understanding Firewall Technology
1. Introduce the firewall technologies described in this section.
a. Network address translation (NAT)
Network Address Translation
2. Describe the use of PAT, which is used to map thousands of internal IP addresses to one
external IP address.
Hands-On Ethical Hacking and Network Defense, Third Edition 13-6
Teaching
Tip
Access Lists
1. Mention that access lists are also used to filter traffic based on source IP address,
Packet Filtering
1. Explain that packet filters screen packets based on information contained in the packet
header, such as:
a. Protocol type
Stateful Packet Inspection
1. Explain that stateful packet filters record session-specific information about a network
connection.
2. Describe how stateful packet filters can recognize types of anomalies that most routers
ignore.
Teaching
Tip
Read more about stateful packet inspection at
http://www.webopedia.com/TERM/S/stateful_inspection.html.
Application Layer Inspection
1. Explain that an application-aware firewall inspects network traffic at a higher level in
Implementing a Firewall
1. Explains why demilitarized zones (DMZs) are used.
Hands-On Ethical Hacking and Network Defense, Third Edition 13-7
Demilitarized Zone
1. Define DMZ as a small network containing resources available to Internet users.
2. Describe how to configure a good DMZ. You can use Figure 13-2 and Figure 13-3 to
illustrate your explanation.
Teaching
Tip
Check out
http://compnetworking.about.com/cs/networksecurity/g/bldef_dmz.htm for more
information regarding DMZs.
Understanding the Cisco Adaptive Security Appliance Firewall
1. Mention that Cisco ASA has replaced the Cisco PIX firewall and added advanced
Configuring the ASA Firewall
2. Explain how to change to a different configuration mode once inside the ASA firewall.
3. Give detailed examples of configuration rules and files. Use the examples in the book to
Using Configuration and Risk Analysis Tools for Firewalls and Routers
1. Mention that one of the best Web sites for finding configuration benchmarks and
2. Using Figure 13-4, Illustrate the use of RedSeal, a unique network risk analysis and
mapping tool.
Teaching
Tip
Visit the official RedSeal Web site at http://www.redseal.net/.
Understanding Intrusion Detection and Prevention Systems
1. Explain the difference between an intrusion detection system (IDS) and an intrusion
Hands-On Ethical Hacking and Network Defense, Third Edition 13-8
Network-Based and Host-Based IDSs and ISPs
2. Describe the differences between passive systems and active systems.
Web Filtering
1. Review the methods hackers use once they get into a network. They try to get users to
2. Point out that blocking access to uncategorized sites is a very effective security practice
but could cause inconvenience for users.
Security Operations Center (SOC)
1. Explain that in large organizations that have sensitive or critical data, normal
2. Define SOC as a permanent team whose members are responsible solely for security-
3. Mention that Security Information and Event Management (SIEM) tools can help the
teams identify attacks and indicators of compromise by collecting, aggregating, and
Understanding Honeypots
1. Define a honeypot as a computer placed on the perimeter of a network that contains
information intended to lure and then trap hackers.
2. Explain that honeypot computers are configured to have vulnerabilities and that one
Hands-On Ethical Hacking and Network Defense, Third Edition 13-9
How Honeypots Work
2. Use Table 13-4 and Table 13-5 to describe some of the existing commercial and open-
source honeypots.
3. Explain how virtual honeypots are created.
Teaching
Tip
Visit http://www.opencanary.org/en/latest/ for an overview of OpenCanary.
Quick Quiz 2
1. What are hardware devices or software installed on a system that serve two purposes:
controlling access to all traffic that enters an internal network, and controlling all traffic
that leaves an internal network?
2. Which of the following is a small network containing resources that a company wants to
make available to Internet users?
A. honeypot
B. intrusion detection system
C. honeynet
D. DMZ
3. Which of the following monitor network devices so that security administrators can
identify attacks in progress and stop them?
A. honeypot
B. DMZ
C. intrusion detection system
D. firewall
4. Systems that don’t take any action to stop or prevent an activity are called which of the
following?
A. passive systems
B. honeypots
C. active systems
D. web filters
5. Stateful packet filters record session-specific information about a network connection in
a file known as which of the following?
A. routing table
B. state table
C. NAT table
D. access list
Class Discussion Topics
1. What are the main differences between Network Address Translation (NAT) and Port
Address Translation (PAT)? Explain both to your class.
2. Assume that you work in a company with a firewall configured to protect the internal
network from the outside Internet. Ask your students whether they would recommend
installing and configuring personal firewalls on all company workstations as well. Why
or why not?
Additional Projects
1. Ask your students to investigate Iptables. They should learn how to write rules using
2. Ask students to visit the following websites and learn how to edit an Iptables rules file.
Additional Resources
2. How Firewalls Work:
3. Personal Firewall Reviews:
4. Snort:
5. Linux Iptables HOWTO:
6. A Virtual Honeypot Framework:
Key Terms
See Glossary for definitions of Key Terms.
➢ active systems
➢ anomaly-based IDS
➢ honeypot
➢ host-based IDSs/IPSs
➢ indicators of compromise
➢ intrusion detection systems (IDSs)
➢ intrusion prevention systems (IPSs)
➢ IP access lists
Hands-On Ethical Hacking and Network Defense, Third Edition 13–12
➢ path-vector routing protocol
➢ privileged mode
➢ security appliance
➢ Security Information and Event Management (SIEM)
Technical Notes for Activities
Activity 13-1: This activity requires a computer running Windows, an Internet connection,