Security Operations · Topic 7 of 13
Network Security Capabilities and Protocols
Security+ network controls: firewall rules, IDS and IPS, web and DNS filtering, and secure protocols with their port numbers such as 22, 443 and 636.
- 4 min
- Firewall rules are read in order, and the list ends with a default deny.
- IDS alerts. IPS blocks because it is inline.
- Signature based detection needs regular updates.
What it is
Enterprises improve security by changing and tuning the tools they already have. This page covers network side changes: firewall rules, intrusion detection and prevention, web and DNS filtering, and replacing insecure protocols with secure ones.
The exam gives a problem, such as clear text traffic or a risky site, and asks which change fixes it.
How it works
Firewall rules and access lists
A firewall rule lists a source, destination, port or protocol, and an action. Rules are checked in order, so more specific rules go before general ones, and the list ends with a default deny. An access control list (ACL) works in a similar way on routers and switches.
Good practice is to allow only what is needed, document each rule and remove rules that are no longer used. Review rule sets regularly, since old rules leave open paths.
Intrusion detection and prevention
An intrusion detection system (IDS) alerts on suspicious traffic. An intrusion prevention system (IPS) sits inline and can block it. Both use signatures, which match known attack patterns, and may also use behavior or anomaly detection.
Trends in the alerts, such as repeated scans from one source, show where to tighten rules. Signature databases need regular updates to catch new threats.
Web and DNS filtering
| Control | How it works |
|---|---|
| Web filter | Controls access to sites by category, uniform resource locator (URL), reputation or content |
| Agent based filter | Software on the device applies policy wherever the device is |
| Centralized proxy | Traffic is sent through a proxy that applies the policy |
| DNS filtering | The Domain Name System (DNS) resolver refuses to resolve known malicious or blocked domains |
Filtering by content category lets an organization block categories such as malware sites or gambling. DNS filtering stops the connection before it starts, because the name never resolves.
Secure protocols
Many older protocols send data and credentials in clear text. The exam expects you to know the secure replacement and the usual port.
| Insecure protocol | Port | Secure replacement | Port |
|---|---|---|---|
| Telnet | 23 | Secure Shell (SSH) | 22 |
| Hypertext Transfer Protocol (HTTP) | 80 | Hypertext Transfer Protocol Secure (HTTPS) | 443 |
| File Transfer Protocol (FTP) | 20 and 21 | SFTP over SSH, or FTPS | 22 for SFTP |
| Simple Mail Transfer Protocol (SMTP) | 25 | SMTP secured with TLS, submission on 587, or SMTPS | 587 or 465 |
| Post Office Protocol 3 (POP3) | 110 | POP3S | 995 |
| Internet Message Access Protocol (IMAP) | 143 | IMAPS | 993 |
| Lightweight Directory Access Protocol (LDAP) | 389 | LDAPS | 636 |
| Simple Network Management Protocol (SNMP) version 1 or 2c | 161 | SNMP version 3 | 161 |
The secure names add an S for secure: IMAPS, POP3S, SMTPS and LDAPS are the mail and directory protocols running over TLS, and FTPS is FTP over TLS. SFTP is the Secure Shell File Transfer Protocol, which runs inside an SSH session.
Other ports to know are DNS on 53, Dynamic Host Configuration Protocol (DHCP) on 67 and 68, Network Time Protocol on 123, Remote Desktop Protocol on 3389, and Server Message Block on 445. Remote Authentication Dial In User Service (RADIUS) commonly uses 1812 and 1813.
Replacing a protocol includes three choices: which protocol, which port and which transport method. Transport Layer Security (TLS) version 1.2 or 1.3 is the usual choice, and old versions, including the Secure Sockets Layer (SSL), should be disabled.
Making the change
Before blocking an insecure protocol, identify who uses it, move them to the secure one and then close the old port.
What to remember for the exam
- Firewall rules are read in order, and the list ends with a default deny.
- IDS alerts. IPS blocks because it is inline.
- Signature based detection needs regular updates.
- DNS filtering blocks malicious domains by refusing to resolve them.
- Use SSH 22 not Telnet 23, HTTPS 443 not HTTP 80, and LDAPS 636 not LDAP 389.
- Secure mail uses IMAPS 993, POP3S 995 and a TLS protected SMTP.
- Use SNMP version 3 instead of earlier versions.
- Disable old TLS and SSL versions and prefer TLS 1.2 or 1.3.
When a question shows traffic on port 23, 80, 21 or 110, the likely answer is to replace the protocol with its encrypted equivalent.
Common mistakes
Putting a broad allow rule above a specific deny. The broad rule matches first, so the deny never applies.
Mixing up the secure port numbers. Practice the pairs: 22, 443, 636, 993 and 995.
Believing a web filter protects only on the office network. An agent based filter can follow the device, while a proxy only covers traffic sent through it.
Assuming TLS means safe. Outdated versions and weak ciphers weaken it.
Blocking a protocol without checking dependencies. A business application may still depend on it.
Leaving an old rule in place after a system is retired keeps a path open to an address that may be reused.
Check yourself
Which secure protocol replaces Telnet, and on which port does it run?
Secure Shell (SSH) on port 22.
What is the difference between an IDS and an IPS?
An IDS detects and alerts, while an IPS sits inline and can block the traffic.
How does DNS filtering protect users?
It refuses to resolve known malicious domains, so the connection never starts.
Topic 7 of 13 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.