Please enable JavaScript.

Coggle requires JavaScript to display documents.

Module 11: IPS TEchnologies, image - Coggle Diagram

- - - - Security operations center (SOC) tools, such as security information and event management (SIEM) and security orchestration, automation, and response (SOAR) systems automate the log file gathering and analysis process.
        
        Intrusion Detection Systems (IDS) were implemented to passively monitor the traffic on a network.
        
        Working offline, the IDS compraes the captured traffic stream with known malicious signatures, similar to software that checks for viruses
        
        Although the traffic is monitored, logged, and perhaps reported, no action is taken on packets by the IDS.
        
        The advantage of operating with a copy of the traffic is that the IDS does not negatively affect the packet flow of the forwarded traffic.
        
        The disadvantage of operating on a copy of the traffic is that the IDS cannot stop malicious single-packet attacks from reaching the target.
  - - - Types of system available
      - Host-based and network-based approaches
      - Placement of these systems
      - Role of signature categories
      - Possible actions that a Cisco IOS router can take when an attack is detected
  - - - Advantages
        
        No impact on network (latency, jitter)
        
        No network impact if there is a sensor failure
        
        No network impact if there is sensor overload
      - Disadvantages
        
        Response action cannot stop trigger packets
        
        Correct tuning required for response actions
        
        More vulnerable to network security evasion techniques
    - - Advantages
        
        Stops trigger packets
        
        Can use stream normalization techniques
      - Disadvantages
        
        Sensor issues might affect network traffic
        
        Sensor overloading impacts the network
        
        Some impact on network (latency, kitter)
- - - - Host-based IPS (HIPS) is software installed on a host to monitor and analyze suspicious activity.
      - Advantages
        
        Provides protection specific to a host operating system
        
        Provides operating system and application level protection
        
        Protects the host after the message is decrypted
      - Disadvantages
        
        Operating system dependent
        
        Must be installed on all hosts
    - - A network-based IPS can be implemented using a dedicated or non-dedicated IPS device such as a router. Network-based IPS implementations are a critical component of intrusion prevention.
  - - - On a Cisco Firepower appliance
      - On an ASA firewall device
      - On an ISR router
      - As a virtual Next-Generation IPS (NGIPSv) for VMware
    - - NIC
        Must be able to connect to any network (Ethernet, Fast Ethernet, Gigabit Ethernet)
      - Processor
        Intrusion prevention requires CPU power to perform intrusion detection analysis and pattern matching
      - Memory
        Intrusion detection analysis is memory-intensive. Memory directly affects the ability of a network-based IPS to efficiently and accurately detect an attack
  - - - Puts the IPS directly into the traffic flow and makes packet-forwarding rates slower by adding latency
    - - The sensor analyzes a copy of the monitored traffic, not the actual forwarded packet
      - Advantage
        
        The sensor does not affect the packet flow with the forwaded traffic
      - Disadvantage
        
        The sensor cannot stop malicious traffic from reaching its intended target for certain types of attacks
- - - - To validate traffic, the detection engine compares incoming traffic with known attack signatures that are included in the IPS attack signature package.
    - - This is a list of known attack signatures that are contained in one file. The signature pack is updated frequently as new attacks are discovered.
  - - - Snort inspects the traffic and reports alerts, but does not take any action to prevent attacks
        
        In these modes, Snort performs the following actions
        
        Monitors network traffic and analyzes against a defined rule set
        
        Performs attack classification
        
        Invokes actions against matched rules
    - - In addition to intrusion detection, actions are taken to prevent attacks
- - - - Network TAPs (Test Access Points)
      - Traffic mirroring using SPAN (Switch Port Analyzer)
        
        11.4.3 Traffic Mirroring and SPAN
        
        Port mirroring enables the switch to copy frames that are received on one or more ports to a Switch Port Analyzer (SPAN) port that is connected to an analysis device.
        
        Ingress traffic
        Traffic that enters the switch
        
        Egress traffic
        Traffic that leaves the switch
        
        Source (SPAN) port
        Source ports are monitored as traffic entering them is replicated (mirrored) to the destination ports
        
        Destination (SPAN) port
        A port that mirrros source ports. Destination SPAN ports often connect to analysis devices such as a packet analyzer or an IDS
        
        The association between source ports and a destination port is called a SPAN session. In a single session, one or multiple ports can be monitored.