Intrusion Prevention

Intrusion Prevention

1. IDS

   • Intrusion Detection System.
   • Monitor the traffic
   • Offline
     • works passively
     • compare
       • traffic stream
       • malicious signatures
   • Device in network
   • traffic mirrored
     • traffic monitored and reported
     • the IDS does not affected
     • cannot stop malicious attacks quickly
     • requires assistance
       • routers
       • Firewalls

2. IPS

   • Intrusion Prevention System
   • Inline
     • Traffic flow through IPS
       • Detect and expose a problem
   • Monitors
     • Layer 3 and 4
       • Find malicious data
         • At layers 2 to 7
   • Mixed technologies
     • Signature-based
     • Profile-based
     • Protocol analysis-based
     • Intrusion Detection
   • stop single-attacks
   • can affect the packet flow
   • Hardware
     • Sensors
       • detect in real time
       • Intrusion prevention analysis
       • Factors that affect the selection
         • Amount of network traffic
         • Network topology
         • Security budget
         • Security budget staff to manage IPS
     • Components
       • NIC
         • Can connect to any network
       • Processor
       • Memory
         • Efficiency and accuracy

3. Zero-Day Attacks

   • Exploit software vulnerabilities

4. Signatures

   • Detect
     • Atomic patterns
     • Composite patterns
   • Detect breaches of security
   • Attributes
     • Type
       • Atomic
       • Composite
     • Trigger
       • types
         • Pattern-based detection
           • Search pre-defined pattern
           • might be
             • Textual
             • Binary
             • Function calls
           • Difficult
             • Protocols
             • Not well-defined ports
         • Anomaly-based detection
           • Define a profile
             • Normal to the network
             • Learned by
               • Monitoring activity
                 • Period of time
               • Specific applications
                 • Period of time
               • Defined specification
                 • RFC
           • Detect
             • New attacks
             • Previously unpublished attacks
           • Free of attack on learning phase
           • False positives
         • Policy-based detection
           • Define suspicious behaviors
             • historical analysis
             • cover classes of activities
         • Honey pot-based detection
           • Dummy server
             • Attract attacks
           • Distract Attacks
           • Anylize attacks
             • Tune sensor signatures
               • Levels
                 • High
                 • Medium
                 • Low
                 • Informational
           • Used for research
       • Protocol decodes
         • break down a packet
           • Reduce the number of false positives
           • Search in a specific field
       • Types of alarms
         • False positive
         • False negative
         • True positive
         • True positive
     • Action
       • Categories
         • Generate an alert
           • Atomic
             • Each signature
           • Summary
             • Set of same signature
               • Same source address
               • Same port
         • Log the activity
           • Store on a file
             • Retrieve to analize
           • Generate an alert
         • Drop or prevent the activity
           • Packets through 2 interfaces
             • Analize and determine
               • Forward
               • Drop
                 • Expand to
                   • Connection
                   • Host
         • Block future activity
           • Temporaly ACLs
             • Attacking System
             • Multiple locations
         • Allow activity
           • Exceptions
         • Reset a TCP Connection
           • End connection with unwanted actions
   • Rules to detect intrusion activity
   • Signature file
   • Regular expression
     • pattern in a serie of bytes
   • Signature Micro-Engines (SME)
     • Categorize signatures in groups
     • Types
       • Atomic
         • Simple packets
       • Service
         • Examine many services
       • String
         • Use regular expression-based
       • Multi-string
         • Flexible pattern matching
         • Trend Labs signatures
       • Other
         • handles miscellaneous signatures

5. Added to

   • ISR Router
   • firewall appliance
   • Catalyst 6500 switch