8 - Firewall/Intrusion

Question 1

Packet filtering vs stateful inspection

Answer 1

Stateful tightens rules for TCP traffic by creating directory of TCP connections

Records information

Question 2

Anomaly detection vs misuse detection

Answer 2

Anomaly detection - collect data on users, determine if new behavior is consistent, not as widely used

Misuse detection - identify malware that has patterns we know

Question 3

Firewall deployments

Answer 3

Yes

Question 4

Base rate fallacy

Answer 4

Can’t ignore probability of no attack when there is an alert

There is a normal amount of alerts in steady state