Please enable JavaScript.

Coggle requires JavaScript to display documents.

Chapter 3: Network Security Infrastructure - Coggle Diagram

- - - - IDS (Intrusion Detection System)
        
        Detects suspicious activity or potential attacks.
        
        Monitors and alerts the administrator but does not block traffic
        
        Works by comparing network traffic against: Known attack signatures (like antivirus patterns) and Anomaly detection (unusual behavior in traffic flow)
      - IPS (Intrusion Prevention System) - Detects and blocks malicious activity in real time.
        
        Actively drops packets, blocks IPs, or resets connections if it detects an attack.
        
        Often sits inline with the traffic path (e.g: between router and firewall).
      - IDS and IPS - Work Together =
        in modern networks, IDS and IPS are often integrated into a single system called a Next-Generation Intrusion Prevention System (NGIPS)
        Feature - IDS and IPS
        Position- Out-of-band (monitors copies of traffic) & Inline (sits in the traffic path)
        Response - Alerts administrator & Blocks and prevents attacks
        Goal - Detection and visibility & Real-time prevention
        Tools - Snort, OSSEC & Suricata, Cisco Firepower
      - Benefit of IDS and IPS work together
        
        Real-time threat detection: Identifies malicious activity as it happens
        Automatic Prevention (IPS): Blocks attacks before damage occurs
        Visibility into Network Traffic: Helps administrators monitor unusual patterns
        Forensic evidence: Logs and alerts can be used in investigations