CompTIA A+ Certification All-in-One Exam Guide

scope of an A+ tech’s duties, the CompTIA 1002 objectives cover two
devices critical to modern network security—IDS and IPS—plus the concept
of unified threat management. Let’s take a look.
An intrusion detection system (IDS) is an Internet application that inspects
packets, looking for active intrusions. An IDS functions inside the network,
watching for threats that a firewall might miss, such as viruses, illegal logon
attempts, and other well-known attacks. Plus, because it inspects traffic inside
the network, the IDS can discover internal threats, like the activity of a
vulnerability scanner smuggled in on a flash drive by a disgruntled worker
planning an attack on an internal database server.
An IDS always has some way to let the network administrators know if an
attack is taking place: at the very least the attack is logged, but some IDSs
offer a pop-up message, an e-mail, or even a text message to an
administrator’s phone. An IDS can also respond to detected intrusions with
action. The IDS can’t stop the attack directly, but can request assistance from
other devices—like a firewall—that can.
An intrusion prevention system (IPS) is very similar to an IDS, but an IPS
sits directly in the flow of network traffic. This active monitoring has a trio of
consequences. First, an IPS can stop an attack while it is happening. There’s
no need to request help from any other devices. Second, the network
bandwidth and latency take a hit. Third, if the IPS goes down, the network
link might go down too. Depending on the IPS, it can block incoming packets
on-the-fly based on IP address, port number, or application type. An IPS
might go even further, literally fixing certain packets on-the-fly.
All these network Internet appliances, no matter how advanced and aware
they become, are still singular tools in the box used to protect networks. That
is why modern dedicated firewall/Internet appliances are built around
providing unified threat management (UTM). UTM takes the traditional
firewall and packages it with many other security services such as IPS, VPN,
load balancing, antivirus, and many other features depending on the make
and model. The UTM approach to building network gear helps build robust
security deep into the network, protecting what really matters: our data.
Authentication and Encryption
You know that the first step in securing data is authentication, through a user
name and password. But when you throw in networking, you’re suddenly not