The myth of the firewall as the protector of the internal network has been effectively debunked. In modern networking in particular, demanding users and the race-to-market share tip the balance of border security on the side of users and functions. In addition, those who would exploit and destroy information assets have become increasingly sophisticated in crafting malware that exploits Port 80 and other commonly used ports that have to be made available to users. There are several lines of defense available to network and security administrators, including intrusion prevention and detection technologies. The nature of malware and vulnerability exploits is that there is nearly always a lag time between the discovery of the vulnerability and the creation and application of the fix that will mitigate that vulnerability. It is also true that network and security administrators are too often faced with too much work and not enough resources and are, in the end, human beings. The activities and tools that are available to monitor and test the security levels on a modern network are varied. They range from free open source to very expensive and sophisticated technologies. They come in single-use solutions and best-of-breed solutions, which are typically "Swiss Army knife" solutions that perform a variety of activities.

Complete the Toolwire lab, use the study materials, and engage in any additional research needed to fill in knowledge gaps. Write a 23 page paper that covers the following:

What are the criteria that a network or security administrator should use when selecting the proper network monitoring tool?

How do security managers allow technical staff to have access to these monitoring tools while ensuring that they are not misused?

What determines whether the use of network monitoring tools is beneficial or exploitative in nature?