All language subtitles for 3. Next Generation Firewall and IPS

In this section we are going to take a look to the next generation firewalls and the IP guys firewalls

are as standard security tool for the majority of companies.

But in today's changing threat landscape next generation firewalls are the only firewalls that can provide

proper protection.

The former firewalls were just able to perform some protocol inspections and port inspections.

But these did pack inspection firewalls are moving beyond Port protocol inspection and blocking to add

the application level inspection intrusion probation and bragging bringing intelligence from outside

the firewall so as the name suggests next generation firewalls are a more advanced version of the traditional

firewall and they offer some benefits.

But next generation firewall has some advanced features like regular firewalls next generation firewall

use both static and dynamic packet filtering and weeping and support to ensure that all connections

between the network internet and firewall are valid and secure both firewall types should also be able

to translate to network and port addresses in order to map eyepiece.

There are also fundamental differences between the traditional firewall and next generation firewalls.

The most obvious difference between the two is next generation firewalls ability to filter packets based

on application skies.

These firewalls have extensive control and visibility of applications that is able to identify using

analysis and signature matching.

So that means for example a if you want to block Skype in a network or if you want to block Facebook

in a network or any other application you can do it with the next generation firewall which is not possible

to do it with a traditional firewall.

And also they can use swipe lists or a signature based IP as to distinguish between safe applications

and unwanted ones which are then identified using SSL decryption.

Unlike most traditional firewalls next generation firewalls also include a path through which feature

updates will be received.

And let's go ahead with the benefits of next generation firewalls and next generation firewall performs

traditional firewall features like state for firewall filtering net and VPN termination.

And it's also providing us application visibility and control.

This feature looks deep into the application layer data to identify the application.

For instance it can identify the application based on the data rather than put number to defend against

attacks that use random port numbers.

Next Generation firewall also provide advanced malware protection guys and GSW platforms through multiple

security services not just as a platform to run a separate service but for better integration of functions

and network based anti malware function can run on the firewall itself blocking the files files transfers

that will install malware and saving copies of files for later analytics.

Also next generation firewalls can provide you are L filtering this feature exam mines.

There you are.

Else in each rep request categorizes the URLs and either filters or rape limits the traffic based on

rules.

Also next generation firewalls can run their NGO IP as next generation IP as feature along with their

firewall.

Let's talk about the IP as intrusion prevention system also an IP address is a network security threat

prevention technology that Exim minds the network traffic flows to detect and prevent vulnerability

exploits while durability exploits usually come in the form of malicious inputs to a target application

or service that attackers use to interrupt and gain control of an application or mission following a

successful exploit the attacker can disable the target application or can potentially access to all

the rights and permissions available for the compromised the application the IP is guys often sits directly

behind the firewall and provides a complementary layer of analyses that negatively selects for the dangerous

content and also I need to tell this one a IP as is not as separate hardware in today's networks and

most of are integrated the fire was so unlike its predecessor the intrusion detection system idea as

which is a passive system that scans traffic and reports back on threats.

The eyepiece is placed to inline actively analyzing and taking automated actions on all traffic flows

that enter the network.

Specifically these actions include like sending an alarm to administrator dropping the malicious packets

blocking traffic from the source address and resetting the connection as an inline security component.

The IP is must work efficiently to avoid degrading network performance.

It must also work fast because exploits can happen in near real time.

The IP address must also detect and respond accurately so as to eliminate threats and false positives

and the IP as guys has a number of detection methods for finding exploits.

But signature based detection and statistical anomaly based detection are the two dominant mechanisms

signature based detection is based on a dictionary of uniquely identifying patterns or signatures in

the code of each exploit as an exploit is discovered.

It is signature is recorded and stored in a continuously growing dictionary of signatures.

Signature detection for IP is breaks down into two types.

First exploit facing signatures.

Identify individual exploits by triggering on the unique patterns of a particular exploit attempt.

The IP address can identify specific exploits by finding a match with an exploit facing signature in

the traffic stream.

And second while liability facing signatures are broader signatures that target the underlying vulnerability

in the system that is being targeted.

These signatures allow the networks to be protected from variants of an exploit that may not have been

directly observed in the wild but also raise the risk of false positives and also IP as can provide

statistical anomaly detection.

Statistical anomaly detection takes samples of network traffic at random and compares them to a pretty

calculated baseline performance level.

That is a really really cool feature.

Guys when the sample of network traffic activity is outside the parameters of baseline performance the

eyepiece takes action to handle the situation.