- Welcome to Lesson 11:
Given a Scenario, Apply Security Principles
to Secure Enterprise Infrastructure.
In 11.1, we're gonna talk about
network devices fairly generically
but getting an understanding
of what network devices are, what they can do,
and how they make decisions.
So let's define different types
of network devices first,
starting with an appliance.
An appliance is a self-contained resource
that provides a specific function.
Now, other types of network devices,
appliance being the most popular,
are sensors and collectors.
A sensor is a device that collects information
about a network or host.
And a sensor can report,
but it can also take some action.
A collector is a device
that performs targeted collection,
which ultimately feeds into an aggregation
or into a correlation engine.
Let's talk about some device attributes.
Devices can be passive, they can be active,
they can be in line,
or they can be what's known as tap.
The passive devices simply allow data
to pass through, right?
So an example would be things like a patch panel,
or a coupler, or a splitter.
An active network device can control
or modify data as it passes through the network.
So examples include things like switches,
and routers, and firewalls.
When we say that a device is inline,
what we're saying is that it sits directly
in the path of network traffic,
and it can actively process data packets
as they pass through it.
So our examples include IPSs, firewalls,
and load balancers.
Now a network tap is a passive device
that's used to monitor network traffic
by copying all the packets
that actually pass through a network connection.
So passive, active, inline, or tap.
Now, devices have to make decisions, right?
Is this good traffic, is this bad traffic?
Or should I report on this?
Or should I not report on this?
So devices will have decision states.
Now, software does the same thing.
Software will have decision states
or when you're running a vulnerability scan, right?
That vulnerability scanner will have decision states.
It has to tell you is this good, is this bad?
Is this right or is this wrong?
So I wanna go through four basic decision states.
True positive, false positive, true negative,
and false negative.
Now, I want to give you a little caveat.
As we're going through this, you might say,
"Well, that's not the way my vendor
actually uses those terms."
And that's true, like, different vendors
seem to, like, weirdly use these terms differently.
But this is how you need to know it for the exam.
In a true positive, the normal
or expected activity is correctly identified.
Now, you see I say normal or expected.
So it could be either what's normal
or expected in cases of what I'm looking for,
what I expect to find is correctly identified.
Well, that's good, right?
That's really good.
A false positive is where normal
or expected activity is incorrectly identified
as abnormal or unexpected.
And that's problematic.
Everything's really okay, right?
Everything's fine, right?
It's the activity is normal
or expected what you're looking for,
but it's not being tagged that way.
It's being identified as abnormal or unexpected.
It would be like if you did a vulnerability scan,
and the system came back and said,
"You're missing a bunch of patches."
And you're like, "I know I installed those patches."
Well, it turns out those patches
were installed as part of a security patch
or a bigger update.
And so the vulnerability scanner didn't know to look,
you know, there for that piece of information.
So it comes back, and it's not there.
And so it's problematic in the sense
that now you've gotta just spend time
and energy kinda researching why
you're getting this response, this false positive.
A true negative is when abnormal
or unexpected activity is correctly identified.
That's really good.
And then we have our very, very dangerous state,
our false negative.
Our false negative is when abnormal
or unexpected activity is incorrectly identified
as being just fine, as being normal or expected.
And that is a really, really dangerous state
because that's when the system
or the device is saying, "Everything's fine,"
but it's not.
So true positive, everything's good.
And if the system tells us, "We're okay,"
that's good, right?
False positive, everything's okay.
But the system says, "Not really."
That's problematic 'cause we now have to spend
time figuring it out and researching it.
True negative telling us
that something's wrong, abnormal or unexpected,
and that's good, we wanna know that.
False negative, that's the dangerous one.
That's when that abnormal or unexpected activity
is incorrectly identified as either being normal
or what you were expecting to find.
So good, problematic, good, dangerous.
Now, devices also have failure modes.
So when they fail, what can happen?
And the two failure modes in devices
are gonna be fail-open and fail-closed.
Now, fail-open means that the network device
allows the network traffic to continue to flow
even if the device fails.
Now the setting is really intended
to prevent disruptions to network connectivity
and minimize the impact of a hardware
or software failure on network operations.
So for example, in a fail-open in a firewall,
if the firewall failed, you know,
ingress and egress traffic to the internet
would still be allowed, that's fail-open.
It's also referred to as fail-safe.
When we talked about physical security,
we talked about in a building, let's say,
if all of the doors defaulted to unlocked, right,
or open, that would be fail-safe.
Fail-close means that the network device
blocks network traffic even if the device fails.
So that setting is intended
to ensure network security
by preventing any unauthorized access
to network resources in the event
of a hardware or software failure.
So going back to our example at the firewall,
if the firewall failed, you wouldn't be able
to get to the internet.
Now, that's also referred to as fail-secure.
Remember back when we talked about physical security,
and we talked about if all the doors locked
or closed, that would be fail-secure.
So we used the term fail-open or sometimes fail-safe,
fail-closed, sometimes fail-secure.
And that brings us to a three-second challenge.
Five challenge questions, three seconds each,
all about just devices in general.
The device type that can control or modify data
as it passes through the network.
One, two, three.
It's gonna be an active device.
Number two, a passive device
used to monitor network traffic
by copying all of its packets.
One, two, three, that's a tap.
Number three, the decision state where normal
or expected activity is incorrectly
identified as abnormal or unexpected.
One, two, three.
That's gonna be a false positive.
Number four, another decision state.
The decision state when abnormal
or unexpected activity is incorrectly
identified as normal or expected.
This is the one I said was really dangerous.
One, two, three.
That's a false negative.
And number five, in this failure mode,
network traffic continues to flow.
One, two, three.
And that would be fail-open or fail-safe.
Awesome, let's go into our Security-in-Action.
This one's about decision states.
Your company recently installed an inline
intrusion prevention system, an IPS,
and we'll be talking about IPSs shortly
in an upcoming lesson.
Now, it's become obvious to everyone
that the device needs to be fine-tuned.
However, there's an internal debate about tuning.
Specifically, which is worse?
A false positive
or a false negative?
Now, there's a concurrent debate
about the best configuration,
which we're debating, fail-open or fail-closed?
So how do you respond to this debate?
All right, internal debate,
doesn't really matter that it's an IPS, right?
That's almost irrelevant to our
Security-in-Action case study here.
Really the question is what's worse?
False positives or false negatives?
And what would be the best configuration?
A fail-open or a fail-closed?
Go ahead and put me on pause.
Take a moment, write down your response,
and then come on back.
A false positive means that normal activity
is incorrectly identified as abnormal.
So this decision state really results in time spent
diagnosing a moot issue, right?
Nothing's really wrong but we're busy
trying to troubleshoot and diagnose it.
But a false negative means that the abnormal activity
is incorrectly identified as normal.
So this decision state
often results in a problem not being identified,
which could result in a successful attack.
So this is arguably the more dangerous decision state.
The fail-open allows traffic to continue to flow,
whereas fail-closed would stop traffic.
We don't really have an answer for them yet
in this one, right?
Several factors really need to be weighed
to make that decision.
It's not just cut and dry.
We always want a fail-open
or always want a fail-closed.
We really need to look at the device
and what the impact would be of fail-open or fail-closed.
So being part of this discussion,
understanding what we mean
by false positives and false negatives
and fail-open and fail-closed,
that is the job of a security practitioner,
and it's obviously security in action.
All right, there you go, there's your word cloud.
Make sure that you can speak to all of these terms
and concepts before you move on.
And when you're ready,
come on over to the next lesson.
I'll be waiting for you right there.