Month 7: Upgrade the defenses

IDS/IPS: signatures and trends

Signatures match known attack patterns: precise and low noise, but blind to new attacks. Trends (anomaly or behavior-based detection) learn what normal traffic looks like and flag deviations, so they can catch new attacks but raise more false positives. Keep signatures updated and baselines realistic.

Web filtering

Control which websites users can reach.

• Agent-based: software on each device filters wherever it goes, even at home.
• Centralized proxy: all web traffic passes through one proxy at the company edge.
• URL scanning: checks each requested URL against threat data. Content categorization: blocks by category (gambling, malware).
• Block rules: explicit allow/deny lists. Reputation: scores sites by their history; block low-reputation domains.

DNS filtering

DNS filtering stops users from resolving known malicious or blocked domains, so connections fail before they begin. It works for every app on the device, not only browsers, and is cheap to deploy at the resolver.

Implementation of secure protocols

Three decisions. Protocol selection: use the secure version (SSH not Telnet, SFTP not FTP, HTTPS not HTTP, LDAPS not LDAP, SNMPv3 not v1/v2c). Port selection: use the right, expected port for the secure service and close the insecure one. Transport method: make sure the data is actually protected in transit, by the protocol itself (TLS) or a tunnel (VPN, IPSec).

Insecure       port   Secure          port
Telnet         23     SSH             22
FTP            20/21  SFTP            22
HTTP           80     HTTPS           443
LDAP           389    LDAPS           636
SNMP v1/v2c    161    SNMPv3          161

Exam tip Trap: moving a service to a non-standard port is not encryption. Telnet on port 2323 is still clear text.

Email security

Three DNS-based checks stop spoofed mail, plus a gateway:

• SPF (Sender Policy Framework): a DNS TXT record listing which servers may send mail for the domain.
• DKIM (DomainKeys Identified Mail): the sender signs messages with a private key; receivers check with the public key in DNS.
• DMARC (Domain-based Message Authentication Reporting and Conformance): tells receivers what to do when SPF/DKIM fail (none, quarantine, reject) and sends reports.
• Gateway: an email security gateway filters spam, phishing, malware and data leaving by email.

Exam tip Memory trick: SPF = who may send. DKIM = was it signed. DMARC = what to do if not, and tell me.

Endpoint and data capabilities

Know each tool's job:

• File integrity monitoring (FIM): alerts when important files change (system binaries, configs).
• DLP: detects and blocks sensitive data leaving the organization.
• NAC (network access control): checks a device's identity and health (patches, AV) before letting it on the network.
• EDR/XDR: EDR records and responds to threats on endpoints; XDR extends that across endpoints, network, cloud and email.
• User behavior analytics (UBA): learns normal user behavior and flags anomalies like 3 a.m. bulk downloads.