The advancement in computer technology has definitely brought in concomitant benefits to communications technology. Many people nowadays can’t seem to be at peace and relaxed without using mobile devices and computers. Most companies likewise, however big or small, need computer networks and infrastructure to survive in this highly competitive world. These computers and mobile devices also need an operating system and relevant software to effectively perform their specific functions. These programs, however, are vulnerable to attacks from intruding worms, viruses, and other malware, and thus, your mobile devices and computers would definitely need protection.
Defending Against Zero-Day Attacks
Almost every program or application has a “hole of vulnerability” that is yet unknown to the software developer, vendor, and user. Aside from software, hardware and firmware likewise have their own inherent vulnerabilities to attacks. This vulnerability is usually exploited by hackers before a user, a vendor, or the software developer becomes aware of this vulnerability. This vulnerability is called Zero Day Attack vulnerability. The zero-day attack can be left undiscovered for months, and for this reason, it can adversely affect the computer’s data and performance. Developers often can do the patchwork for the software vulnerability only after the discovery of the vulnerability.
There are several security resources that are currently utilized to protect a network. These security resources may include anti-virus (AV) software, firewalls, intrusion detection system, intrusion prevention systems, cyber security standard, log-monitoring and honeypots.
An antivirus is a signature-based software that operates at the file level and is used in capturing infections due to a virus or a Trojan. Firewalls are, as its name implies, barriers between secure and insecure network, and it controls and monitors network traffic. Firewalls control network traffic based on predetermined fixed security rules. Firewalls likewise operate mainly as a preventive security concept for computer networks.
Intrusion detection system or IDS is a search for malicious signature from whole packets, via the analysis of both the header and the payload of the packets. Upon detection of a threat, the IDS sends an alert to the intrusion prevention system or IPS. The IPS is a dynamic security concept that not only actively rejects packets, but also adds new rules. Log-monitoring, on the other hand, increases real-time security visibility by monitoring system logs, application logs, service logs, and other logs, and it enhances awareness within the network infrastructure. Cyber security standard prevents attacks by adding security guidelines to software and infrastructure such as those of hardened kernels and updates.
Understanding Decoy Network and Honeypots
Honeypots are decoy computer resources that either seduce or distract an attacker from its intended target, analyze attack patterns, and then gather information about the attacker. Decoy computer resources like honeypots can be an essential part of a layered computer defence. Decoys can supplement other security resources by luring attackers into traps that direct the attackers into decoy network that mirrors existing assets. This allows network security managers to gain valuable time for the defensive computer resources to detect, analyze, and localize the threat. Decoy computer resources like honeypots are likewise, capable of real-time attack detection against zero-day attacks. However, decoys simply delay the attack rather than defeating it. Other computer security resources or dedicated patches are usually needed to defeat such attacks. At present, it is a common occurrence to see a security resource with multiple defensive concepts.
