Hybrid idps systems event correlation

Reserve For Catherine Owens

9. What is network footprinting?

10. What is network fingerprinting?

11. How are network footprinting and network fingerprinting related?

12. Why do many organizations ban port scanning activities on their internal networks?

13. Why would ISPs ban outbound port scanning by their customers?

14. What is an open port? Why is it important to limit the number of open ports to those that are absolutely essential?

15. What is a system’s attack surface? Why should it be minimized when possible?

16. What is a vulnerability scanner? How is it used to improve security?

17. What is the difference between active and passive vulnerability scanners?

18. What is Metasploit Framework? Why is it considered riskier to use than other vulnera- bility scanning tools?

19. What kind of data and information can be found using a packet sniffer?

20. What capabilities should a wireless security toolkit include?

Exercises 1. A key feature of hybrid IDPS systems is event correlation. After researching event cor-

relation online, define the following terms as they are used in this process: compression, suppression, and generalization.

2. ZoneAlarm is a PC-based firewall and IDPS tool. Visit the product manufacturer at www.zonelabs.com and find the product specification for the IDPS features of ZoneA- larm. Which ZoneAlarm products offer these features?

3. Using the Internet, search for commercial IDPS systems. What classification systems and descriptions are used, and how can they be used to compare the features and com- ponents of each IDPS? Create a comparison spreadsheet to identify the classification systems you find.

4. Use the Internet to search for “live DVD security toolkit.” Read a few Web sites to learn about this class of tools and their capabilities. Write a brief description of a live DVD security toolkit.

5. Several online passphrase generators are available. Locate at least two on the Internet and try them. What did you observe?

Case Exercises Miller Harrison was still working his way through his attack protocol.

Nmap started out as it usually did, by giving the program identification and version num- ber. Then it started reporting back on the first host in the SLS network. It reported all of

7

Case Exercises 445

Copyright 2018 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. WCN 02-300