Setting Up Sensors and Sensor Groups

Configuring & Implementing: Monitoring Connections

A sensor is commonly placed on a connection to monitor traffic between the network to be protected and other networks. In Figure 10.10, a protected enterprise network is comprised of two intranets: the E-Commerce network and the R&D network. Here, sensors have been deployed to monitor four different types of connections. Starting from the upper left, the sensors offer the following protection:

• Perimeter Protection  The most common deployment for a sensor is to be placed between the network to be protected and the Internet. This is known as perimeter protection.

• Remote Access Protection   A dial-in server is used only by employees but may still be vulnerable to external attack. A sensor is placed on the interior side of the dial-in server connection.

• Intranet Protection   While the R&D network is an internal network, it may require a different level of security and hence a sensor is deployed between the two intranets.

• Extranet Protection   A business partner may have similar network security policies but the level of protection may differ. A sensor is deployed between the two extranets.