Implementing Intrusion Prevention

Implementing Intrusion Prevention

1. IPS Technologies

   • IDS and IPS Characteristics
     • Monitor for Attacks
       • One approach to prevent worms and viruses from entering a network is for an administrator to continuously monitor the network
     • Detect and Stop Attacks
       • An IPS builds upon IDS technology. However, an IPS device is implemented in inline mode.
     • Zero-Day Attacks
       • Internet worms and viruses can spread across the world in a matter of minutes. A network must instantly recognize and mitigate worm and virus threats.
     • Similarities Between IDS and IPS
       • A router configured with Cisco IOS IPS software A device specifically designed to provide dedicated IDS or IPS services A network module installed in an adaptive security appliance (ASA), switch, or router
   • Network-Based IPS Implementations
     • Host-based IPS (HIPS) is software installed on a single host to monitor and analyze suspicious activity.
     • A network-based IPS can be implemented using a dedicated or non-dedicated IPS device.
   • Cisco Switched Port Analyzer
     • Port Mirroring
       • A packet analyzer can be a valuable tool to help monitor and troubleshoot a network.
     • Cisco SPAN
       • The SPAN feature on Cisco switches sends a copy of each frame entering the source port,
     • Configuring Cisco SPAN using Intrusion Detection
       • The Switched Port Analyzer (SPAN) feature on Cisco switches sends copies of the frame

2. IPS Signatures

   • IPS Signature Characteristics
     • Signature Attributes
       • Types
         • File
     • To make the scanning of signatures more efficient, Cisco IOS software relies on signature micro-engines (SMEs), which categorize common signatures in groups.
   • IPS Signature Alarms
     • Signature Alarm
       • The heart of any IPS signature is the signature alarm, which is often referred to as the signature trigger.
     • Pattern-Based Detection
     • Anomaly-Based Detection
       • Anomaly-based detection, also known as profile-based detection, involves first defining a profile of what is considered normal for the network or host.
   • IPS Signature
     • Signature Actions
   • Manage and Monitor IPS
     • Monitor Activity
   • IPS Global Correlation
     • n addition to maintaining signature packs, Cisco IPS includes a security feature called Cisco Global Correlation. With global correlation,

3. Implement IPS

   • Configure Cisco IOS IPS with CLI
     • The show ip ips privileged EXEC command can be used with other parameters to provide specific IPS information. The show ip ips all command displays all IPS configuration data, as shown in Figures 1 and 2. The output can be lengthy depending on the IPS configuration. The show ip ips configuration command displays additional configuration data that is not displayed with the show running-config command.
   • Verify and Monitor IPS
     • Implement IOS IPS
       • Cisco IOS IPS enables administrators to manage intrusion prevention on routers. Cisco IOS IPS monitors and prevents intrusions by comparing traffic against signatures of known threats and blocking the traffic when a threat is detected.
   • Modifying Cisco IOS IPS Signature
     • You can also use the IOS CLI to change signature actions for one signature or a group of signatures based on signature categories. To change an action, the event-action command must be used in IPS Category Action mode or Signature Definition Engine mode.