Advanced Threat Protection and Network Architecture / Communication Security
頻出~58 min8 terms18 past questions
Goals of this unit
Tell EDR from SIEM by what each watches (a single device, or logs from many devices), and explain that DLP looks at the content of the data itself.
Distinguish a quarantine network (検疫ネットワーク) from a DMZ by what sits there: devices not yet let into the company network, or servers published to the outside.
Explain which part of the communication path SSL/TLS and a VPN each protect, and list what an administrator can do with MDM when a device is lost.
EDR continuously records and monitors activity on endpoints (エンドポイント), meaning the PCs, servers and other devices at the edges of a network, and after an intrusion it detects suspicious behavior and helps with the response.
Keep recording device activity
Detect suspicious activity
Cut the device off the network
Use the records to trace cause and scope
Follow the remaining records to find how the attacker got in and how far the impact reaches.
4 / 4
Traditional antivirus software mainly blocks intrusions by matching files against the signatures of known malware. EDR assumes a breach may happen anyway and uses behavior-based detection (振る舞い検知), which watches what programs actually do, so it can notice attacks whose signatures are not yet known and limit the damage early. When it finds suspicious activity, the device is cut off from the network and the records are used to investigate the cause and scope.
AnalogyThink of a security guard patrolling inside a building. Apart from the locks on the entrance, when the guard notices something odd inside, they shut the room and rewind the camera footage to investigate.
How to rememberShort for Endpoint Detection and Response. The D (detection) and R (response) show that it is about finding and dealing with threats rather than keeping them out.
Exam points
ExamBehavior-based detection watches what programs do and stops suspicious actions such as unplanned outbound transmissions, which makes it a defense against unknown attacks.
Mix-upTraditional antivirus guards the entrance by matching known signatures, whereas EDR watches behavior after an intrusion in order to detect and respond.
DLP identifies the content of data that must be protected, such as confidential or personal information, and blocks it or issues a warning when it is about to leave the organization.
Register rules for protected data
Watch sending and copying
Block or warn on a match
Block or warn only when data matching the registered conditions is about to leave.
3 / 3
Rules defining what counts as confidential, such as keywords it contains or the type of document, are registered in advance, and data is stopped only when matching content moves through email, copying to external storage or printing. Because DLP watches the data itself rather than the user, it can also catch mistaken sends or removals by employees who hold legitimate access rights.
AnalogyIt is like the staff at a building exit who check bags. No matter who is carrying them, documents that must not leave are kept inside.
How to rememberShort for Data Loss Prevention. Here, loss does not mean data getting corrupted; it means data slipping out of the organization.
Exam points
Mix-upA firewall mainly decides what to let through by the sender and destination of the traffic, while DLP decides by whether the content being sent is confidential.
SIEM gathers the logs produced by servers, network devices and security products in one place and uses correlation analysis (相関分析) to find signs of attack.
Each device emits logs
Collect them in SIEM
Link them by correlation
Alert on signs of attack
If the linked sequence looks like an attack, it alerts the staff in charge.
4 / 4
Correlation analysis means matching logs from different devices by time, source and similar fields, and linking them as related events. Activity that looks harmless in one device's log can reveal the course of an attack once the pieces are connected. The collected logs also serve as material for tracing what happened after an incident.
AnalogyIt is like a security center that shows every camera feed in the building side by side. Movements you would miss on a single screen reveal a suspicious route once the feeds are put together.
How to rememberThe name combines security information management (SIM) and security event management (SEM), and in Japanese it is read シーム, like "seem."
Exam points
Mix-upAn IDS is a device that watches network traffic to find intrusions, while SIEM collects logs from many devices, IDSs included, and analyzes them across the board.
EDR vs. SIEM
Aspect
EDR
SIEM
Key differenceWhat it watches
Activity on each individual device (PC or server)
All the logs collected from many devices
Main role
Detects suspicious activity and helps isolate and investigate
Correlates logs to find signs of attack
How they relate
One of the sources that feeds logs to SIEM
Gathers records from EDR and others to view them together
A quarantine network (検疫ネットワーク) first connects a device that wants to join the internal LAN to a separate inspection segment, and lets it onto the internal LAN only after confirming it is safe.
Device asks to connect
Connect to the inspection segment
Inspect the device
If it passes, join the internal LAN
Only devices that meet the standard are allowed onto the internal LAN.
4 / 4
The inspection checks the state of the device, such as whether operating system patches have been applied and whether antivirus software is up to date. Devices that fall short are kept off the internal LAN and held in the inspection segment until the fixes are done. The aim is to stop infections from spreading inside the company through devices that may have been connected to unknown networks elsewhere.
AnalogyIt follows the same flow as an airport quarantine station, where travelers returning from abroad are checked and let into the country only if nothing is wrong.
How to rememberThe Japanese name uses 検疫, meaning quarantine inspection: 検 is "to examine" and 疫 is "epidemic." As the characters say, a device is checked for infection before it is let in.
Exam points
ExamThe purpose of a quarantine network is to keep devices with security problems off the internal LAN. That role differs from a firewall, which filters outside traffic at the network boundary.
A DMZ is an intermediate zone separated by firewalls from both the outside (the internet) and the internal LAN, and it is where servers open to the public are placed.
Zone
What is placed there
Connections from outside
Connections to the internal LAN
Internet (outside)
Anyone
―
Blocked
DMZ
Public servers (web, mail and so on)
Only the published services
Blocked
Internal LAN
Staff PCs, servers holding confidential data
Blocked
―
Outside users can reach the servers in the DMZ, but traffic from the DMZ to the internal LAN is stopped by a firewall. A public server placed directly on the internal LAN would, if taken over, become a doorway straight into the company. Keeping it in the DMZ means that even if the public server is compromised, attackers find it hard to use it as a stepping stone (踏み台) into the internal LAN.
AnalogyIt is like a company's reception lobby. Visitors can enter the lobby, but a locked door stands between it and the offices behind, so trouble in the lobby cannot reach the offices.
How to rememberShort for DeMilitarized Zone, a military term for a buffer area placed between two opposing sides.
Exam points
ExamPublic servers go in the DMZ so that an attack on one of them does not spread damage to the internal LAN. Mail servers are placed there too, so they cannot be used as a stepping stone from the outside into the internal network.
ExamWhere a server goes depends on whether it must be open to the outside. Public servers belong in the DMZ, and servers holding confidential company data belong on the internal LAN.
ExamA DMZ is a zone created through firewall settings. It accepts connections from both the outside and the internal LAN, but connections from the DMZ to the internal LAN are not allowed.
SSL/TLS is a protocol that encrypts communication, for example between a browser and a web server, and uses a server certificate (サーバ証明書) to confirm that the server on the other end is genuine.
Browser asks to connect
Server sends its certificate
Verify certificate, share key
Encrypted communication
From then on, everything exchanged stays encrypted all the way from the browser to the web server.
4 / 4
A server certificate is an electronic certificate in which a trusted third party, a certificate authority, vouches for who owns the server. On the web, HTTP communication over SSL/TLS is called HTTPS, and its URLs begin with https://. SSL is the older predecessor and today its improved successor TLS is used, but the two are commonly referred to together as SSL/TLS.
AnalogyIt is like checking the other person's ID and then exchanging letters in envelopes no one can see through. Whoever handles them along the way cannot read what is inside.
How to rememberThe final s in https stands for secure. If the s is there, the communication is protected by SSL/TLS.
Exam points
ExamHTTPS encryption covers the entire path from the browser to the web server. Wireless LAN encryption (WPA2) protects only the link between the device and the access point (the wireless base station), so whether it is on has no effect on HTTPS encryption.
ExamWhat a certificate-verified SSL/TLS connection tells you is that the site is not a fake and that the content cannot be read in transit. It does not vouch for how trustworthy the site's operator is.
ExamTo start encryption with SSL/TLS, the server prepares a server certificate and presents it to the browser. HTTPS is the way web communication is protected with SSL/TLS.
A VPN builds a virtual private network that only subscribers or employees can use on top of a network shared by many users, so that it can be used much like a leased line.
Internet VPN (over the internet)
IP-VPN (a carrier's closed network)
Network used
The internet
A closed network a carrier provides to its subscribers
How it stays secure
Authentication and encryption protect the channel
Uses a network only subscribers can enter
Guaranteed quality such as bandwidth
No
Yes
VPNs are used for remote work, where staff connect to the internal LAN from outside, and for linking distant offices. Two common forms are the Internet VPN (インターネットVPN), which runs over the internet, and the IP-VPN, which uses a closed network that a carrier provides only to its subscribers.
AnalogyIt is like digging a screened tunnel, open only to your own group, through a public road everyone travels. You share the same road, yet no one outside can see what goes on inside.
How to rememberVirtual Private Network: not a real dedicated line (virtual), yet usable as if it were your own (private). The name describes exactly what it is.
Exam points
ExamAn Internet VPN runs over a network anyone can use, so it secures traffic by combining authentication, which confirms who is connecting, with encryption of the content.
ExamAn IP-VPN uses a carrier's closed network, so it can guarantee communication quality such as bandwidth. An Internet VPN cannot offer this guarantee.
Mix-upChecking a device's security status before it joins the company network is the job of a quarantine network, not a feature of a VPN.
MDM lets administrators remotely manage, all in one place, the smartphones and other devices a company issues for work.
What admins can do with MDM
Monitor device status
Push settings
Enforce screen lock
Restrict usable apps
Response to loss or theft
Remote lock
Wipe or factory-reset data
A management program (an agent) is installed on each device in advance, letting administrators monitor device status from their own desks and restrict which apps can be used. If a device is lost or stolen, they can lock it or erase its data remotely to prevent information leaks.
AnalogyIt is like a control center for a company's fleet of cars. It keeps every car's settings the same and can shut off the engine remotely if one is stolen.
How to rememberShort for Mobile Device Management. The similar-looking DMZ ends in Zone and is about networks, while MDM starts with Mobile and is about devices.
Exam points
ExamA typical MDM feature is that administrators can remotely lock a device, or erase and reset its data, in case it is lost or stolen.
Mix-upBringing your own device into work use is called BYOD, which is a different term from MDM. MDM refers to the system for managing devices.
ExamWith MDM, administrators can push security settings such as a mandatory screen lock uniformly to every work device.
EDR constantly watches device activity and responds to anything suspicious by isolating and investigating. Behavior-based detection lets it react to unknown attacks as well.
DLP focuses on the content of protected data and stops it from leaving the company, while SIEM collects logs from many devices and correlates them.
A quarantine network inspects devices before they join the internal LAN, and a DMZ is a zone that keeps public servers separated from the internal LAN.
SSL/TLS encrypts the whole path between browser and web server and uses a server certificate to confirm the server is genuine.
A VPN builds a virtual network over a shared one that works like a leased line, and an Internet VPN keeps it secure through authentication and encryption. MDM manages work mobile devices remotely and can lock or wipe them when they are lost.