Firewalls, IDS/IPS, web filters, OS security (GPO, SELinux)

4.3 Modify enterprise capabilities

📘CompTIA Security+ (SY0-701)

---

Enterprise capabilities refer to the security tools and settings that organizations use to protect their networks, systems, and data. Modifying these means configuring them correctly to defend against threats while allowing business operations to continue smoothly.

The main tools you need to know are:

1. Firewalls
2. IDS/IPS (Intrusion Detection/Prevention Systems)
3. Web Filters
4. Operating System (OS) Security – like Group Policy Objects (GPO) and SELinux

---

1. Firewalls

A firewall is a security device (hardware or software) that controls traffic between networks. Think of it as a checkpoint that decides which data can enter or leave a network.

• Purpose:
  • Prevent unauthorized access.
  • Allow legitimate business traffic.
  • Block attacks like malware, hackers, or suspicious connections.
• Types:
  1. Packet-filtering firewall: Checks basic info like IP address, port, and protocol. Fast but simple.
  2. Stateful firewall: Tracks connections to ensure only valid sessions pass. More secure than packet-filtering.
  3. Next-Generation Firewall (NGFW): Can inspect applications, detect malware, and block advanced threats.
• Configuration Tips for Enterprises:
  • Create allow lists for necessary services and deny all else.
  • Use zones (like separating internal network, DMZ, and external internet).
  • Regularly update rules to adapt to new threats.

---

2. IDS/IPS (Intrusion Detection/Prevention Systems)

These systems monitor network traffic to detect and respond to attacks.

• IDS (Intrusion Detection System):
  • Monitors traffic and alerts you if it detects suspicious activity.
  • Does not block the attack.
• IPS (Intrusion Prevention System):
  • Monitors and actively blocks attacks in real-time.
  • Can automatically drop malicious packets or terminate sessions.
• Deployment:
  • IDS/IPS can be network-based (NIDS/NIPS) or host-based (HIDS/HIPS).
  • Network-based protects traffic flowing across the network.
  • Host-based protects individual servers or endpoints.
• Enterprise Use Cases:
  • Detect malware, brute-force login attempts, suspicious file transfers.
  • Alert security teams and prevent potential breaches automatically.

---

3. Web Filters

Web filters control access to websites and web content. They help enforce policies and block threats coming from the internet.

• Purpose:
  • Block malicious websites.
  • Prevent access to non-work-related or harmful sites.
  • Protect users from phishing attacks.
• Types of Web Filtering:
  1. URL filtering: Blocks specific websites or categories (like gambling or adult sites).
  2. Content filtering: Blocks pages with certain keywords or file types (like .exe downloads).
  3. DNS filtering: Stops devices from resolving domain names for malicious sites.
• Enterprise Configuration:
  • Use company policy to decide which categories to block.
  • Combine with logging and monitoring to track attempted accesses.

---

4. Operating System (OS) Security

Securing the operating system ensures devices themselves are protected from unauthorized access and misuse. Two major tools are GPO and SELinux.

a. GPO (Group Policy Objects) – Windows environments

• Purpose: Manage settings across multiple Windows computers in a network from a central server.
• Capabilities:
  • Enforce password policies (complexity, expiration).
  • Control software installation.
  • Restrict access to certain folders or USB drives.
  • Configure firewall and network settings automatically.
• Benefit for Enterprises: Makes sure all computers follow the same security rules, reducing human errors.

b. SELinux (Security-Enhanced Linux) – Linux environments

• Purpose: Provides mandatory access control on Linux systems.
• Capabilities:
  • Restrict what processes and users can do.
  • Prevent malware from modifying critical files even if it gains access.
  • Define policies for applications (like a web server can only access web files).
• Benefit: Adds an extra layer of security beyond standard Linux permissions.

---

Key Exam Points for 4.3

• Firewalls control traffic based on rules (allow/deny, packet/stateful inspection).
• IDS alerts you; IPS blocks attacks automatically.
• Web filters prevent access to harmful or inappropriate content.
• OS security:
  • GPO for centralized Windows policy management.
  • SELinux for strict process and file access control on Linux.
• Enterprises need to configure, tune, and update these tools regularly for maximum protection.

---

✅ Quick Memory Tip for the Exam:
Think of the 4 tools as layers of protection:

Firewall → IDS/IPS → Web Filter → OS Security

• Each layer adds security and controls what users or attackers can do.

---