Assignment-2 Introduction To Communication and Technology: (B-1) FA21-BCS-053

I.
ASSIGNMENT-2
INTRODUCTION TO COMMUNICATION AND TECHNOLOGY
PRESENTED BY:
MUHAMMAD KASHIF
SECTION: (B-1)
REGISTRATION NO: FA21-BCS-053
MUHAMMAD ARSLAN
SECTION: (B-1)
REGISTRATION NO: FA21-BCS-052
Presented to:
MS. BEENISH NOOR
COMSAT UNIVERSITY ISLAMABAD WAH

CONTEXT
1. Antivirus
2. FIREWALL
3. INTRUSION DETECTION
Antivirus
Antivirus1 software is a class of program designed to prevent, detect and remove malware
infections on individual computing devices, networks and IT systems.
Antivirus software, originally designed to detect and remove viruses from computers, can also
protect against a wide variety of threats, including other types of malicious software, such as key
loggers, browser hijackers, Trojan horses, worms, rootkits, spyware, adware, botnets and
ransomware.
Working
Antivirus software typically runs as a background process, scanning computers, servers or
mobile devices to detect and restrict the spread of malware. Many antivirus software programs
include real-time threat detection and protection to guard against potential vulnerabilities as they
happen, as well as system scans that monitor device and system files looking for possible risks.
Functions:
 Scanning directories or files for known malicious patterns indicating the presence of
malicious software.
 Allowing users to schedule scans so they run automatically.
 Allowing users to initiate new scans at any time and removing any malicious software it
detects.
Types
Antivirus software is distributed in a number of forms, including stand-alone antivirus scanners
and internet security suites that offer antivirus protection, along with firewalls, privacy controls
and other security protections.
Windows antivirus software. Most antivirus software offers several levels of Windows
products at different price points, starting with free versions offering only basic protection. Users
must start scans and updates manually and typically free versions of antivirus software won’t
protect against links to malicious websites or malicious attachments in emails. Premium versions
of antivirus software often include suites of endpoint security tools that may provide secure
online storage, ad blockers and file encryption. Since 2004, Microsoft has been offering some
kind of free antivirus software as part of the Windows operating system.
Mac OS antivirus software. Although mac OS viruses exist, they’re less common than
Windows viruses, so antivirus products for mac OS are less standardized than those for
Windows. There are a number of free and paid products available, providing on-demand tools to
protect against potential malware threats through full-system malware scans and the ability to sift
through specific email threads, attachments and various web activities.
Android antivirus software. Android is the world’s most popular mobile operating system and
is installed on more mobile devices than any other OS. Because most mobile malware targets
Android, experts recommend all Android device users install antivirus software on their devices.
Vendors offer a variety of basic free and paid premium versions of their Android antivirus
software including anti-theft and remote-locating features. Some run automatic scans and
actively try to stop malicious web pages and files from being opened or downloaded.
Virus Detection Techniques
Antivirus software uses a variety of virus detection techniques.
Originally, antivirus software depended on signature-based detection to flag malicious software.
Antivirus programs depend on stored virus signatures – unique strings of data that are
characteristic of known malware. The antivirus software uses these signatures to identify when it
encounters viruses that have already been identified and analyzed by security experts.
Signature-based malware cannot detect new malware, including variants of existing malware.
Signature-based detection can only detect new viruses when the definition file is updated with
information about the new virus.
Firewall
A firewall2 is software or firmware that prevents unauthorized access to a network. It inspects
incoming and outgoing traffic using a set of rules to identify and block threats. Firewalls are used
in both personal and enterprise settings, and many devices come with one built-in, including
Mac, Windows, and Linux computers. They are widely considered an essential component of
network security.
Importance
Firewall are important because they have had a huge influence on modern security techniques
and are still widely used. They first emerged in the early days of the internet when networks
needed new security methods that could handle increasing complexity. Firewall have since
become the foundation of network security in the client-server model the central architecture of
modern computing. Most devices use firewalls to inspect traffic and mitigate threats.
Uses
 Firewalls are used in both corporate and consumer settings.
 They may be installed at an organization’s network perimeter to guard against external
threats, or within the network to create segmentation and guard against insider threats.
 In addition to immediate threat defense, firewalls perform important logging and audit
functions.
 In a single home network, a firewall can filter traffic and alert the user to intrusions.
Working
A firewall establishes a border between an external network and the network it guards. It is
inserted inline across a network connection and inspects all packets entering and leaving the
guarded network. As it inspects, it uses a set of pre-configured rules to distinguish between
benign and malicious packets.
Types
When categorizing by filtering method, the main types are:
i. Packet-filtering firewall examines packets in isolation and does not know the packet’s
context.
ii. Stateful inspection firewall examines network traffic to determine whether one packet is
related to another packet.
iii. Proxy firewall inspects packets at the application layer of the Open Systems
Interconnection (OSI) reference model.
iv. Next Generation Firewall uses a multilayered approach to integrate enterprise firewall
capabilities with an intrusion prevention system (IPS) and application control.
Intrusion Detection System

An intrusion detection3 system (IDS) is a system that monitors network traffic for suspicious
activity and alerts when such activity is discovered.
While anomaly detection and reporting are the primary functions of an IDS, some intrusion
detection systems are capable of taking actions when malicious activity or anomalous traffic is
detected, including blocking traffic sent from suspicious Internet Protocol (IP) addresses. An IDS
can be contrasted with an intrusion prevention system (IPS), which monitors network packets for
potentially damaging network traffic, like an IDS, but has the primary goal of preventing threats
once detected, as opposed to primarily detecting and recording threats.
Working
Intrusion detection systems are used to detect anomalies with the aim of catching hackers before
they do real damage to a network. IDSes can be either network- or host-based. A host-based
intrusion detection system is installed on the client computer, while a network-based intrusion
detection system resides on the network.
Intrusion detection systems work by either looking for signatures of known attacks or deviations
from normal activity. These deviations or anomalies are pushed up the stack and examined at the
protocol and application layer. They can effectively detect events such as Christmas tree scans
and Domain Name System (DNS) poisonings.
Types
Network intrusion detection system (NIDS). is deployed at a strategic point or points within
the network, where it can monitor inbound and outbound traffic to and from all the devices on
the network.
Host intrusion detection system (HIDS). runs on all computers or devices in the network with
direct access to both the internet and the enterprise’s internal network. A HIDS has an advantage
over an NIDS in that it may be able to detect anomalous network packets that originate from
inside the organization or malicious traffic that an NIDS has failed to detect.
Signature-based intrusion detection system (SIDS). monitors all the packets traversing the
network and compares them against a database of attack signatures or attributes of known
malicious threats, much like antivirus software.
Anomaly-based intrusion detection system (AIDS). monitors network traffic and compares it
against an established baseline to determine what is considered normal for the network with
respect to bandwidth, protocols, ports and other devices. This type often uses machine learning
to establish a baseline and accompanying security policy.
Capabilities of Intrusion Detection Systems
IDSes monitor network traffic to detect an attack do by providing some or all of the following
functions to security professionals:
 Monitoring the operation of routers, firewalls, key management servers and files that are
needed by other security controls aimed at detecting, preventing or recovering from
cyberattacks.
 Providing a user-friendly interface so no expert staff members can assist with managing
system security;
 Recognizing and reporting when the IDS detects that data files have been altered.
 Generating an alarm and notifying that security has been breached.
 Reacting to intruders by blocking them or blocking the server.
Benefits of Intrusion Detection Systems

 Intrusion detection systems offer organizations several benefits, starting with the ability
to identify security incidents.
 An IDS can be used to help analyze the quantity and types of attacks.
 An intrusion detection system can also help companies identify bugs or problems with
their network device configurations. These metrics can then be used to assess future risks.
 Intrusion detection systems can also help enterprises attain regulatory compliance. An
IDS gives companies greater visibility across their networks, making it easier to meet
security regulations.
 Intrusion detection systems can also improve security responses.
-------------------------------------------------------------------------------------------------------------
References:
1. https://searchsecurity.techtarget.com/definition/antivirus-software?amp=1
2. https://searchsecurity.techtarget.com/definition/firewall?amp=1
3.https://www.google.com/amp/s/searchsecurity.techtarget.com/definition/intrusion-detection-system
%3famp=1

Assignment-2 Introduction To Communication and Technology: (B-1) FA21-BCS-053

Uploaded by

Copyright:

Available Formats

Assignment-2 Introduction To Communication and Technology: (B-1) FA21-BCS-053

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Assignment-2 Introduction To Communication and Technology: (B-1) FA21-BCS-053

Uploaded by

Copyright:

Available Formats

I.

REGISTRATION NO: FA21-BCS-053

REGISTRATION NO: FA21-BCS-052

COMSAT UNIVERSITY ISLAMABAD WAH

Intrusion Detection System

Benefits of Intrusion Detection Systems

You might also like