Please enable JavaScript.

Coggle requires JavaScript to display documents.

MODULE 12, (Step 1. Download the Snort OVA file., Step 2. Install the OVA…

- - - - Type - Atomic or Composite
        
        Trigger - Also called the alarm
        
        Action - What the IPS will do
  - - - Atomic Signature - This is the simplest type of signature because a single packet, activity, or event identifies an attack
      - Composite Signature - Also called a stateful signature because the IPS requires several pieces of data to match an attack signature.
  - - - DETECTION TYPE
        
        Pattern-Based Detection
        
        Anomaly-Based Detection
        
        Policy-Based Detection
        
        Honey Pot-Based Detection
      - ADVANTAGES
        
        Also know as signature-based detection, Simplest triggering mechanism as it searches for a specific and predefined atomic or composite pattern
        
        Also know as profile-based detection, Involves first defining a profile of what is considered normal network or host activity
        
        Also know as behavior-based detection, Although similar to pattern-based detection, an administrator manually
        
        Honey pot-based detection uses a server as a decoy server to attract attacks, The purpose of a decoy server is to lure attacks away from production devices
  - - - rue positive - (Desirable) This is used when the IPS generates an alarm because it detected known attack traffic. The alert has been verified to be an actual security incident and also indicates that the IPS rule worked correctly.
      - True negative - (Desirable) This is used when the system is performing as expected. No alerts are issued because the traffic that is passing through the system is clear of threats.
      - False positive - (Undesirable) This is used when an IPS generates an alarm after processing normal user traffic that should not have triggered an alarm. The IPS must be tuned to change these alarm types to true negatives.
      - False negative - (Dangerous) This is used when an IPS fails to generate an alarm and known attacks are not being detected. This means that exploits are not being detected by the security systems that are in place.
- - - - IPS rules that identify and block attack traffic targeted at network vulnerabilities.
      - Tightly integrated defense against advanced malware by incorporating advanced analysis of network and endpoint activity.
      - Sandboxing technology that uses hundreds of behavioral indicators to identify zero-day and evasive attacks.
      - Also includes Application Visibility and Control (AVC), Cisco Advanced Malware Protection (AMP) for Networks, and URL Filtering.
  - - - IDS and IPS mode - Configure threat detection or prevention mode. In prevention mode, attack traffic will be dropped.
      - Three signature levels - Snort provides three levels of signature protection: connectivity (least secure), balanced (middle option), and security (most secure).
      - An allowed list - This provides the ability to turn off certain signatures and helps to avoid false positives such as legitimate traffic triggering an IPS action.
      - Snort health monitoring - Cisco IOS Software keeps track of the health of the Snort engine that is running in the service container.
      - Fail open and close - In the event of IPS engine failure, the router can be configured to block the traffic flow or to bypass IPS checking until the Snort engine recovers.
      - Signature update - Automatic and manual updates are supported. Snort IPS can download the signature package directly from cisco.com or a local resource location over HTTP and HTTPS.
      - Event logging - IPS logs can be sent to an independent log collector or included along with the router syslog stream.
  - - - Snort engine - This is the IPS detection and enforcement engine that is included in the Security (SEC) license for 4000 Series ISRs.
      - Snort rule software subscriptions for signature updates - Snort rule sets to keep current with the latest threat protection are term-based subscriptions, available for one or three years.
  - - - pecifically, the Snort engine on the 4000 Series ISR runs as a container application. The 4000 Series ISR uses a multi-core CPU, and the Cisco IOS-XE has the ability to allocate these cores for control-plane or data-plane functions.
  - - - The basic rule header command syntax is:
        [action] [protocol] [sourceIP] [sourceport] -> [destIP] [destport] ([Rule options])
      - 12.2.9 Snort IPS Operation
  - - - Snort IDS mode can perform the following three actions:
        
        Alert - Generate an alert using the selected alert method.
        
        Log - Log the packet.
        
        Pass - Ignore the packet.
      - Snort IPS mode can perform all the IDS actions plus the following:
        
        Drop - Block and log the packet.
        
        Reject - Block the packet, log it, and then send a TCP reset if the protocol is TCP or an ICMP port unreachable message if the protocol is UDP.
        
        Sdrop - Block the packet but do not log it.