
Identify security domains and representative technologies in each domain.
Understand the definition, DAC, MAC, RBAC mechanisms, and common authentication technologies.
Distinguish packet-filtering, application-level gateway, circuit-level gateway, and deployment models.
Compare signature-based and anomaly-based detection; analyze the advantages and disadvantages of each method.
Introduction to firewalls
Types of firewalls
Access control techniques
Firewall limitations
Access control concepts
Access control measures
Some access control technologies
Introduction
Classification
Intrusion detection techniques
Information security is not confined to a single technical field but spans many layers of protection. Each area uses specialized technologies, yet all are aimed at the same common goal: protecting the confidentiality, integrity, and availability of information.
Access control is a mechanism that ensures only authorized subjects can interact with system resources. It is the foundation for protecting all three core attributes:
A complete access control system consists of three services that work closely together in a unified process:
Verifies the authenticity of identification information. Example: checking a username and password.
Determines which resources may be accessed based on policy and roles after successful authentication.
Foundational service. Adds, removes, and modifies accounts and permissions — supports both Authentication and Authorization, does not directly participate in the access flow but is indispensable.
Access control (Access Control) is a set of mechanisms used to identify, authenticate, and authorize a subject when accessing information system resources. A complete access control system includes three core services:
Verifies the identity of the subject: "Who are you?"
Uses passwords, biometrics, digital certificates, or tokens.
Determines the privileges of the authenticated subject: "What are you allowed to do?"
Based on roles, policies, or specific permission lists.
Manages the lifecycle of accounts and access rights: "Who grants and revokes permissions?"
Includes account creation, role assignment, auditing, and logging.
These three components work sequentially and complement one another, forming a closed-loop access control system. Missing any one of them weakens the entire protection system.
Every access request goes through a strict sequential process. The final result — grant or deny access — must be fully recorded in the system log for auditing.
Discretionary Access Control (DAC) is a mechanism in which the resource owner has full authority to decide who can access it and at what permission level. This model is highly flexible but depends heavily on each user's security awareness.
User A owns the folder /home/A/documents on Linux. User A can grant read permission to B, read/write permission to C, or deny access to everyone.
Command: chmod 750 documents
Access Control Matrix (ACM) is a two-dimensional data structure that represents all access rights of every subject to every object in the system.

Access control matrix model
Access Control List (ACL) is the practical implementation of DAC, in which each object stores a list of (subject, permission) pairs. The operating system checks the ACL whenever there is an access request.
When Bob sends a request to read the file, the operating system scans the ACL from top to bottom, finds the entry "Bob: Read" and allows the action. If Bob requests to write, no Write permission is found → denied.
ACL is the column-based simplification of ACM, organized by object instead of the entire matrix, helping save memory and making management easier.

Access control list model
Mandatory Access Control (MAC) does not let users decide access rights themselves. Instead, the system controls access based on two main factors:
A subject can access an object only if the clearance level ≥ the object's classification label.
Applications: military environments, intelligence, central banks.
The "No Read Up" principle
A subject may only read documents with a classification at or below their clearance level. A lieutenant (Secret level) cannot read a Top Secret document from the general.
The "No Write Down" principle
A subject may only write to documents with a classification at or above their clearance level. A general cannot write Top Secret information into an Unclassified document — this prevents information from leaking to lower levels.
Core principle
Role-Based Access Control (RBAC) does not assign permissions directly to users, but through job roles. Users are assigned to one or more roles, and each role has a specific set of permissions.
Principle of least privilege: each role is granted only the minimum permissions necessary to perform its duties.

Rule-based access control determines access rights through predefined rules, not based on user identity but on attributes of the access request.
Attributes used in rules
Firewall rule examples
Each technology has its own strengths and limitations. In practice, high-security systems often combine two or more factors (Multi-Factor Authentication — MFA) to increase reliability.
Password is the most common authentication factor. The system does not store passwords as plaintext, but instead stores hash values. When a user logs in, the system hashes the entered password and compares it with the stored value.
Factors that determine security:
A public key certificate (Public Key Certificate) is an electronic document that verifies the identity of an entity and binds that identity to a public key. A digital certificate consists of three core components:
The user sees a padlock icon in the browser, ensuring they are communicating with the real bank server, not a spoofed one.
Smartcard is a plastic card with an integrated processor and memory, capable of storing and processing cryptographic authentication information. Smartcard authentication is based on two combined factors:
An attacker must possess both the card and know the PIN to gain access — a higher level of protection than a password alone.
Token is a compact, dedicated device for authentication. Tokens can operate through two main mechanisms:
Advantages: OTP codes change continuously and cannot be reused if stolen.
Limitations: Costs to issue and manage hardware devices; they can be lost or damaged.
Most common, integrated in phones and laptops. High accuracy, fast processing.
Recognizes through a camera, no touch required. Used in access control and phone unlocking.
Very high accuracy, difficult to spoof. High equipment cost, often used in high-security environments.
Authentication through voice characteristics. Sensitive to noisy environments and can be spoofed with recordings.
What is a firewall?
A firewall is a hardware or software device placed at the network boundary that controls the flow of traffic between network zones with different levels of trust.
Core principle
A firewall only allows traffic that is valid according to a set of rules to pass through. Any traffic that does not match the allowed rules is denied by default (default deny).

A dedicated hardware firewall by Cisco
A firewall is a network access control system that operates on the principle of filtering data packets based on a set of rules built according to an organization's security policy. A firewall can be:
Each incoming packet is checked against the rule list in priority order. The first matching rule determines the corresponding action (allow/deny).
Internet (untrusted)
↓
Firewall (network gateway)
↓
DMZ (Web, Mail, DNS Server)
↓
Internal Firewall
↓
LAN (trusted internal network)
Suitable for small networks. One firewall protects the entire internal system.
Suitable for organizations with public-facing services (web, mail, DNS).

Firewall protecting a home or small office network

Firewall system protecting service servers and workstations
Operating layer: Network Layer (Layer 3)
Inspects each packet based on source/destination IP, port, and protocol. Does not care about connection state or content.
Example: Allows TCP packets to port 443, blocks all ICMP packets from outside.
Operating layer: Session Layer (Layer 5)
Checks the TCP handshake process (three-way handshake) to confirm a valid connection before allowing traffic through.
Example: SOCKS proxy blocks connections that have not completed the handshake.
Operating layer: Application Layer (Layer 7)
Understands application semantics (HTTP, FTP, SMTP), and can filter by content, URL, keywords, and application commands.
Example: Web proxy blocks URLs containing banned keywords; filters FTP PUT commands from outside.



Relies on source and destination addresses and fixed parameters to assess risk.
Checks the entire packet content, characteristics, and communication channel.
The choice of firewall depends on the scale, budget, and level of complexity of the environment that needs to be protected.
Determines which Internet services are allowed to be accessed (inbound or outbound), based on IP address and port number.
Example: Allow only HTTP (80) and HTTPS (443); block FTP (21) from outside.
Determines the direction of traffic — inbound or outbound — before allowing a connection.
Example: Allow connections from inside to outside, block all connections from outside to the internal network.
Controls access based on the identity of authenticated users, often applied to internal users connecting remotely via VPN.
Example: Only IT staff are allowed to SSH into the management server.
Controls how services are used — filtering spam, blocking malicious content, limiting bandwidth for specific services.
Example: Filter emails containing .exe attachments; block movie downloads from P2P networks.
The table below illustrates a practical firewall rule set for a system with a web server, mail server, and internal LAN:
The rules are evaluated from top to bottom in order of priority. The final rule (default deny) ensures that any traffic that does not match is denied.
IDS (Intrusion Detection System) is a software or hardware system that monitors and analyzes network traffic or system behavior to detect signs of unauthorized intrusion, record logs, and send alerts.
IPS (Intrusion Prevention System) expands the functions of IDS by adding automatic prevention capability when dangerous behavior is detected.
Intrusion Detection System focuses on a passive monitoring role: analyzing traffic or behavior, detecting signs of abnormal activity, and sending alerts to administrators for response.
Intrusion Prevention System operates inline on the traffic path, with the ability to automatically block, drop packets, or terminate connections as soon as intrusion behavior is detected, without human intervention.

Placement of IDS and IPS systems in the network diagram
NIDS monitors traffic across an entire network segment by placing sensors at strategic points (network gateway, switch mirror port). It analyzes each packet that passes through.
HIDS monitors behavior on each specific host: tracking system logs, configuration file changes, running processes, and executed commands.

NIDS deployed to monitor intrusion detection at the gateway and for each network segment

Using a combination of NIDS and HIDS to monitor network traffic and hosts
In addition to being classified by data source, IDS/IPS are also classified by analysis method for intrusion detection. There are two main approaches:
Signature-based Detection
Compares current traffic or behavior with a database of known attack patterns. Highly effective against familiar attacks but cannot detect new attacks (zero-day).
Anomaly-based Detection
Builds a profile of normal system behavior, then alerts when it detects a significant deviation from that profile. Can detect new attacks but has a higher false positive rate.
How it works
Signature-based detection relies on a database of attack signatures — characteristic patterns of malicious behavior that have been recorded and classified. The IDS matches each segment of traffic or system event against this database.
Simple signature example
Snort rule for detecting a SYN port scan:
alert tcp any any -> $HOME_NET any (flags:S; msg:"SYN Scan Detected"; threshold:type both, track by_src, count 20, seconds 1; sid:1001;)
Flowchart for signature-based intrusion detection monitoring
Anomaly-based detection operates in two separate phases: building a normal behavior profile and then detecting significant deviations from that profile.

Entropy values of source IPs from legitimate traffic (high, uniform values) and entropy of source IPs from DDoS attack traffic (low values)
In normal traffic, source IPs are highly diverse → entropy is high (~3.5–4.0 bits). When a DDoS attack occurs from a small number of sources (a concentrated botnet), source IPs repeat continuously → entropy drops sharply to near 0.
The anomaly-based IDS detects the sudden entropy drop at T5 and raises a DDoS alert even though this is an attack type not present in the signature database.
Chapter 4. Techniques and Technologies for Information Security Assurance