Please enable JavaScript.

Coggle requires JavaScript to display documents.

Module 11.0 IPS tecnologies, image, image, image, image, image, image,…

- - - - Malicious traffic is sent to the target host that is inside the network.
      - The traffic is routed into the network and received by an IPS-enabled sensor where it is blocked.
      - The IPS-enabled sensor sends logging information regarding the traffic to the network security management console.
      - The IPS-enabled sensor kills the traffic. (It is sent to the “Bit Bucket.”)
- - - - The daily operation of a network follows common patterns of traffic flow, bandwidth usage, and resource access, which together define normal network behavior. Security analysts need to be familiar with this normal behavior to detect problems indicated by abnormal activity.
      - To determine normal network behavior, network monitoring is implemented using tools like IDS, packet analyzers, SNMP, and NetFlow. Some of these tools require captured network data, and there are two main methods for capturing and sending traffic to network monitoring devices:
      - Network taps (test access points or TAPs)
      - Traffic mirroring through Switch Port Analyzer (SPAN) or other port mirroring methods.
  - - - Notice how the tap simultaneously sends both the transmit (TX) data stream from the internal router and the receive (RX) data stream to the internal router on separate, dedicated channels. This ensures that all data arrives at the monitoring device in real time. Therefore, network performance is not affected or degraded by monitoring the connection.
      - Taps are also typically fail-safe, which means if a tap fails or loses power, traffic between the firewall and internal router is not affected.
      - Search the internet for information on NetScout Taps for copper UTP Ethernet, fiber Ethernet, and serial links.
  - - - The show monitor command is used to verify the SPAN session. The command displays the type of the session, the source ports for each traffic direction, and the destination port. In the example below, the session number is 1, the source port for both traffic directions is F0/1, and the destination port is F0/2. The ingress SPAN is disabled on the destination port, so only traffic that leaves the destination port is copied to that port.
- - - - Cisco IOS IPS
      - Snort IPS
  - - - Snort can be enabled in either of the following modes:
      - IDS mode - Snort inspects the traffic and reports alerts, but does not take any action to prevent attacks.
      - IPS mode - In addition to intrusion detection, actions are taken to prevent attacks.
- - - - Host-based IPS (HIPS) is software installed on a host to monitor and analyze suspicious activity. A significant advantage of HIPS is that it can monitor and protect operating system and critical system processes that are specific to that host. With detailed knowledge of the operating system, HIPS can monitor abnormal activity and prevent the host from executing commands that do not match typical behavior.
      - Network-based IPS: A network-based IPS can be implemented using a dedicated or non-dedicated IPS device such as a router. Network-based IPS implementations are a critical component of intrusion prevention. Host-based IDS/IPS solutions must be integrated with a network-based IPS implementation to ensure a robust security architecture.
        Sensors detect malicious and unauthorized activity in real time and can take action when required
      - Sample IPS Sensor Deployment.
  - - - Network-based IPS Sensors can be implemented in several ways:
      - On a Cisco Firepower appliance
      - On an ASA firewall device
      - On an ISR router
      - As a virtual Next-Generation IPS (NGIPSv) for VMware
  - - - Promiscuous Mode.
      - Inline Mode.