Implementing Intrusion Prevention

Implementing Intrusion Prevention

1. Zero-Day Attacks

   • Worm and virus threats
     • Monitor for attacks
       • IDSs
         • Cannot stop malicious single-packet attacks
         • No impact on network
         • More vulnerable to network security evasion techniques
       • IPS
         • Can immediately detect and stop an attack.
         • Layer 3 and 4 traffic
         • Detection Technologies
           • Signatures
             • Detect severe breaches of security
             • Detect common network attacks
             • Gather information
         • Sensor issues might affect network traffic.
   • Computer attack that tries to exploit software vulnerabilities
   • Zero-hour

2. Host-Based IPS

   • Provides protection to a host operation system
   • Combination of:
     • Antivirus
     • Antimalware
     • Firewall
   • Operates only at a local level.
   • IPS Sensors
     • Detect malicious activity
     • Factors
       • Amount of network traffic
       • Network topology
         • Network IPS
           • Cost-effective
           • Cannot determine whether an attack was successful
           • Operating system independent
       • Security budget

3. Modes of deployment

   • Inline mode
   • Promiscuous mode

4. Cisco SPAN

   • Items
     • Ingress traffic
     • Egress traffic
     • Source port
     • Dest port
   • Switch
     • Sends copies of the frame entering a port out another port

5. IPS Signature

   • Attributes
     • Type
       • Atomic
       • Composite
     • Trigger (Alarm)
       • Honey Pot-Based Detection
       • Policy-Based Detection
       • Anomaly-Based Detection
     • Action
       • Generating an alet
       • Log the activity
       • Drop or prevent activity
       • Reset a TCP connection
       • Block future activity
   • Signature File
     • Contains a package of network signatures
   • SMEs
     • Atomic
     • Service
     • String
     • Multi-string
     • Other
   • Monitoring Considerations
     • Management method
     • Event correlation
     • Security Staff
     • Incident response plan

Imagens e arquivos do mapa