INTRUSION DETECTION AND PREVENTION SYSTEM (IDPS)
CP
Published · 41 slides · 0 views
1 / 1
Description
INTRUSION DETECTION AND PREVENTION SYSTEM (IDPS) IDPS KEY TERMS intrusion - adverse event in which an attacker attempts to gain entry into an information system or disrupt its normal operations, almost always with the intent to do harm.
Related Topics
Share
Embed code
Download this presentation From Below
"INTRUSION DETECTION AND PREVENTION SYSTEM (IDPS)" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
01
INTRUSION DETECTION AND PREVENTION SYSTEM (IDPS)<br>
02
IDPS KEY TERMS intrusion - adverse event in which an attacker attempts to gain entry into an information system or disrupt its normal operations, almost always with the intent to do harm.
intrusion detection and prevention system (IDPS) - The general term for both intrusion detection systems and intrusion prevention systems.
intrusion detection system (IDS) - A system capable of automatically detecting an intrusion into an organization’s networks or host systems and notifying a designated authority.
intrusion prevention system (IPS) - An IDS system capable of automatically responding to a detected intrusion and preventing it from successfully attacking the organization by means of an active response.<br>
intrusion detection and prevention system (IDPS) - The general term for both intrusion detection systems and intrusion prevention systems.
intrusion detection system (IDS) - A system capable of automatically detecting an intrusion into an organization’s networks or host systems and notifying a designated authority.
intrusion prevention system (IPS) - An IDS system capable of automatically responding to a detected intrusion and preventing it from successfully attacking the organization by means of an active response.<br>
03
IDPS Terminology Alarm clustering and compaction: grouping almost identical alarms occur at the same time, clustering – based on similarity, frequency , other criteria by IDPS admin
Alarm filtering: classifying IDPS alerts so they can be more effectively managed, similar to packet filter, filtering based on address, OS, confidence value, alarm type, alert level etc
Alert or alarm: indication of system attack, alarms in the form of audible signals, e-mail messages, pager notifications, or pop-up windows
Confidence value: measure of an IDPS’s ability to correctly detect and identify attacks, based on experience and past performance measurements.
Evasion: attackers change the format and/or timing of their activities to avoid being detected by an IDPS.
False attack stimulus: triggers an alarm when no actual attack is in progress.
False negative: The failure of an IDPS to react to an actual attack event.<br>
Alarm filtering: classifying IDPS alerts so they can be more effectively managed, similar to packet filter, filtering based on address, OS, confidence value, alarm type, alert level etc
Alert or alarm: indication of system attack, alarms in the form of audible signals, e-mail messages, pager notifications, or pop-up windows
Confidence value: measure of an IDPS’s ability to correctly detect and identify attacks, based on experience and past performance measurements.
Evasion: attackers change the format and/or timing of their activities to avoid being detected by an IDPS.
False attack stimulus: triggers an alarm when no actual attack is in progress.
False negative: The failure of an IDPS to react to an actual attack event.<br>
04
IDPS Terminology False positive: An alert or alarm that occurs in the absence of an actual attack, make users insensitive to alarms , reduce their reactions to actual intrusion events.
Noise: accurate and noteworthy alarms, do not pose significant threats to information security.
Site policy: The rules and configuration guidelines governing the implementation and operation of IDPSs within the organization.
Site policy awareness: ability to dynamically modify its configuration in response to environmental activity , so-called dynamic IDPS
True attack stimulus: An event that triggers an alarm and causes an IDPS to react as if a real attack is in progress.
Tuning: The process of adjusting an IDPS to maximize its efficiency in detecting true positives while minimizing false positives and false negatives.<br>
Noise: accurate and noteworthy alarms, do not pose significant threats to information security.
Site policy: The rules and configuration guidelines governing the implementation and operation of IDPSs within the organization.
Site policy awareness: ability to dynamically modify its configuration in response to environmental activity , so-called dynamic IDPS
True attack stimulus: An event that triggers an alarm and causes an IDPS to react as if a real attack is in progress.
Tuning: The process of adjusting an IDPS to maximize its efficiency in detecting true positives while minimizing false positives and false negatives.<br>
05
Why Use an IDPS? to identify and report an intrusion.
detecting the early signs of an intrusion, the organization can quickly find the attack and prevent or at least substantially mitigate loss or damage to information assets.
also help administrators detect the preambles to attacks, which are known as attack reconnaissance.
also help the organization protect its assets when its networks and systems are still exposed to known vulnerabilities or are unable to respond to a rapidly changing threat environment
known vulnerability A published weakness or fault in an information asset or its protective systems that may be exploited and result in loss<br>
detecting the early signs of an intrusion, the organization can quickly find the attack and prevent or at least substantially mitigate loss or damage to information assets.
also help administrators detect the preambles to attacks, which are known as attack reconnaissance.
also help the organization protect its assets when its networks and systems are still exposed to known vulnerabilities or are unable to respond to a rapidly changing threat environment
known vulnerability A published weakness or fault in an information asset or its protective systems that may be exploited and result in loss<br>
06
Why Use an IDPS? In the process of analysing data and network activity, IDPSs can be configured to log data for later analysis.
This logging function allows the organization to examine what happened after an intrusion occurred and why.
Logging also allows improvement in incident response; evaluation by specialized log monitors
Another reason to install an IDPS is that it serves as a deterrent by increasing the fear of detection among would-be attackers.
If internal and external users know that an organization has an IDPS, they are less likely to probe the system or attempt to compromise it
Data collected by an IDPS can also help management with quality assurance and continuous improvement
An IDPS can provide a level of quality control for security policy implementation.<br>
This logging function allows the organization to examine what happened after an intrusion occurred and why.
Logging also allows improvement in incident response; evaluation by specialized log monitors
Another reason to install an IDPS is that it serves as a deterrent by increasing the fear of detection among would-be attackers.
If internal and external users know that an organization has an IDPS, they are less likely to probe the system or attempt to compromise it
Data collected by an IDPS can also help management with quality assurance and continuous improvement
An IDPS can provide a level of quality control for security policy implementation.<br>
07
Types of IDPSs Network Based - protecting network information assets
Wireless – Wireless networks
Network behavior Analysis (NBA) - examines traffic flow on a network in an attempt to recognize abnormal patterns like DDoS, malware, and policy violations.
Host Based - protects the server or host’s information assets<br>
Wireless – Wireless networks
Network behavior Analysis (NBA) - examines traffic flow on a network in an attempt to recognize abnormal patterns like DDoS, malware, and policy violations.
Host Based - protects the server or host’s information assets<br>
08
Types of IDPSs<br>
09
Network-Based IDPS resides on a computer or appliance connected to a segment of an organization’s network and monitors traffic on that segment, looking for indications of ongoing or successful attacks
When it is programmed to recognize as an attack, it responds by sending notifications to administrators
When examining incoming packets, an NIDPS looks for patterns within network traffic – DoS attack, also examines the exchange of a series of related packets in a certain pattern, which could indicate that a port scan is in progress<br>
When it is programmed to recognize as an attack, it responds by sending notifications to administrators
When examining incoming packets, an NIDPS looks for patterns within network traffic – DoS attack, also examines the exchange of a series of related packets in a certain pattern, which could indicate that a port scan is in progress<br>
10
Network Based IDPS installed at a specific place in the network, such as inside an edge router, where it is possible to monitor traffic into and out of a particular network segment
can be deployed to monitor a specific grouping of host computers on a specific network segment, or it may be installed to monitor all traffic between the systems that make up an entire network.
When placed next to a hub, switch, or other key networking device, the NIDPS may use that device’s monitoring port.
A monitoring port, also known as a switched port analysis (SPAN) port or mirror port, is capable of viewing all traffic that moves through the entire device.<br>
can be deployed to monitor a specific grouping of host computers on a specific network segment, or it may be installed to monitor all traffic between the systems that make up an entire network.
When placed next to a hub, switch, or other key networking device, the NIDPS may use that device’s monitoring port.
A monitoring port, also known as a switched port analysis (SPAN) port or mirror port, is capable of viewing all traffic that moves through the entire device.<br>
11
Network Based IDPS Switches or hubs
Hubs receive traffic from one node and retransmit it to all other nodes - allows any device connected to the hub to monitor all traffic passing through the hub - security risk because anyone connected to the hub can monitor all the traffic that moves through the network segment.
Switches - create dedicated point-to-point links between their ports. These links create a higher level of transmission security and privacy to effectively prevent anyone from capturing and thus eavesdropping on the traffic passing through the switch
the ability to capture the traffic is necessary for the use of an IDPS - monitoring ports are required.
These connections enable network administrators to collect traffic from across the network for analysis by the IDPS, as well as for occasional use in diagnosing network faults and measuring network performance<br>
Hubs receive traffic from one node and retransmit it to all other nodes - allows any device connected to the hub to monitor all traffic passing through the hub - security risk because anyone connected to the hub can monitor all the traffic that moves through the network segment.
Switches - create dedicated point-to-point links between their ports. These links create a higher level of transmission security and privacy to effectively prevent anyone from capturing and thus eavesdropping on the traffic passing through the switch
the ability to capture the traffic is necessary for the use of an IDPS - monitoring ports are required.
These connections enable network administrators to collect traffic from across the network for analysis by the IDPS, as well as for occasional use in diagnosing network faults and measuring network performance<br>
12
Network Based IDPS To determine whether an attack has occurred or is under way, NIDPSs compare measured activity to known signatures in their knowledge base.
The comparisons - through a special implementation of the TCP/IP stack that reassembles the packets and applies protocol stack verification, application protocol verification, or other verification and comparison techniques.<br>
The comparisons - through a special implementation of the TCP/IP stack that reassembles the packets and applies protocol stack verification, application protocol verification, or other verification and comparison techniques.<br>
13
Network Based IDPS protocol stack verification- NIDPSs look for invalid data packets—packets that are malformed under the rules of the TCP/IP protocol
Packet verified for match in any internet protocol, elements of these protocols (IP, TCP, UDP, and application layers such as HTTP) are combined in a complete set called the protocol stack when the software is implemented in an operating system or application.
DoS and DDoS attacks - rely on the creation of improperly formed packets to take advantage of weaknesses in the protocol stack in certain operating systems or applications<br>
Packet verified for match in any internet protocol, elements of these protocols (IP, TCP, UDP, and application layers such as HTTP) are combined in a complete set called the protocol stack when the software is implemented in an operating system or application.
DoS and DDoS attacks - rely on the creation of improperly formed packets to take advantage of weaknesses in the protocol stack in certain operating systems or applications<br>
14
Network Based IDPS application protocol verification, the higher-order protocols (HTTP, SMTP, and FTP) are examined for unexpected packet behavior or improper use. (valid protocol packets in excessive quantities or tiny packets with excessive fragmentation)
protocol stack verification looks for violations in the protocol packet structure, application protocol verification looks for violations in the protocol packet’s use.
One example of this kind of attack is DNS cache poisoning, in which valid packets exploit poorly configured DNS servers to inject false information and corrupt the servers’ answers to routine DNS queries from other systems on the network<br>
protocol stack verification looks for violations in the protocol packet structure, application protocol verification looks for violations in the protocol packet’s use.
One example of this kind of attack is DNS cache poisoning, in which valid packets exploit poorly configured DNS servers to inject false information and corrupt the servers’ answers to routine DNS queries from other systems on the network<br>
15
Network Based - Advantages Good network design and placement of NIDPS devices - monitor a large network using only a few devices.
NIDPSs are usually passive devices, deployed into existing networks with little or no disruption to normal network operations.
NIDPSs are not usually susceptible to direct attack and may not be detectable by attackers.<br>
NIDPSs are usually passive devices, deployed into existing networks with little or no disruption to normal network operations.
NIDPSs are not usually susceptible to direct attack and may not be detectable by attackers.<br>
16
Network Based - Disadvantages become overwhelmed by network volume and fail to recognize attacks
require access to all traffic to be monitored - switched Ethernet Networks – Switches- limited or no monitoring port capability, some networks - not capable of providing aggregate data for analysis by an NIDPS
cannot analyse encrypted packets, making some network traffic invisible to the process
cannot reliably ascertain whether an attack was successful, which requires ongoing effort by the network administrator to evaluate logs of suspicious network activity
Some forms of attack are not easily discerned by NIDPSs, those involving fragmented packets, some NIDPSs are so vulnerable to malformed packets that they may become unstable and stop functioning.<br>
require access to all traffic to be monitored - switched Ethernet Networks – Switches- limited or no monitoring port capability, some networks - not capable of providing aggregate data for analysis by an NIDPS
cannot analyse encrypted packets, making some network traffic invisible to the process
cannot reliably ascertain whether an attack was successful, which requires ongoing effort by the network administrator to evaluate logs of suspicious network activity
Some forms of attack are not easily discerned by NIDPSs, those involving fragmented packets, some NIDPSs are so vulnerable to malformed packets that they may become unstable and stop functioning.<br>
17
Wireless NIDPS monitors and analyzes wireless network traffic, looking for potential problems with the wireless protocols (Layers 2 and 3 of the OSI model).
cannot evaluate and diagnose issues with higher-layer protocols like TCP and UDP.
Wireless IDPS capability can be built into a device that provides a wireless access point (AP).
Sensors - located at the access points, on specialized sensor components, or incorporated into selected mobile stations.
Centralized management stations collect information from these sensors, much as other network-based IDPSs do, and aggregate the information into a comprehensive assessment of wireless network intrusions<br>
cannot evaluate and diagnose issues with higher-layer protocols like TCP and UDP.
Wireless IDPS capability can be built into a device that provides a wireless access point (AP).
Sensors - located at the access points, on specialized sensor components, or incorporated into selected mobile stations.
Centralized management stations collect information from these sensors, much as other network-based IDPSs do, and aggregate the information into a comprehensive assessment of wireless network intrusions<br>
18
Wireless NIDPS Issues in implementation of wireless IDPSs
Physical security
Sensor range
Access point and wireless switch locations
Wired network connections
Cost
wireless IDPS can also detect existing WLANs and WLAN devices for inventory purposes as well as detect the following types of events:
● Unauthorized WLANs and WLAN devices
● Poorly secured WLAN devices
● Unusual usage patterns
● The use of wireless network scanners
● DoS attacks and conditions
● Impersonation and man-in-the-middle attacks<br>
Physical security
Sensor range
Access point and wireless switch locations
Wired network connections
Cost
wireless IDPS can also detect existing WLANs and WLAN devices for inventory purposes as well as detect the following types of events:
● Unauthorized WLANs and WLAN devices
● Poorly secured WLAN devices
● Unusual usage patterns
● The use of wireless network scanners
● DoS attacks and conditions
● Impersonation and man-in-the-middle attacks<br>
19
Network Behavior Analysis System NBA identify problems related to the flow of network traffic, anomaly detection method to identify excessive packet flows that might occur in the case of equipment malfunction, DoS attacks, virus and worm attacks, and some forms of network policy violations.
Typically monitor internal networks but occasionally monitor connections between internal and external networks.
IDP - Source and destination IP addresses, Source and destination TCP or UDP ports or ICMP types and codes , Number of packets and bytes transmitted in the session, Starting and ending timestamps for the session
NBA sensors - deployed in passive mode only, using the same connection methods (e.g., network tap, switch spanning port) as network-based IDPSs<br>
Typically monitor internal networks but occasionally monitor connections between internal and external networks.
IDP - Source and destination IP addresses, Source and destination TCP or UDP ports or ICMP types and codes , Number of packets and bytes transmitted in the session, Starting and ending timestamps for the session
NBA sensors - deployed in passive mode only, using the same connection methods (e.g., network tap, switch spanning port) as network-based IDPSs<br>
20
NBA System most commonly detect:
DoS attacks (including DDoS attacks)
Scanning
Worms
Unexpected application services, such as tunneled protocols, back doors, and use of forbidden application protocols
Policy violations<br>
DoS attacks (including DDoS attacks)
Scanning
Worms
Unexpected application services, such as tunneled protocols, back doors, and use of forbidden application protocols
Policy violations<br>
21
NBA System Sensors - intrusion prevention capabilities - grouped by sensor type:
Passive only: Ending the current TCP session, can attempt to end an existing TCP session by sending TCP reset packets to both endpoints.
Inline only: Performing inline firewalling, offer firewall capabilities that can be used to drop or reject suspicious network activity.
Both passive and inline:
Reconfiguring other network security devices, instruct network security devices such as firewalls and routers to reconfigure themselves to block certain types of activity or route it elsewhere, such as to a quarantined virtual local area network (VLAN).
Running a third-party program or script, run an administrator specified script or program when certain malicious activity is detected<br>
Passive only: Ending the current TCP session, can attempt to end an existing TCP session by sending TCP reset packets to both endpoints.
Inline only: Performing inline firewalling, offer firewall capabilities that can be used to drop or reject suspicious network activity.
Both passive and inline:
Reconfiguring other network security devices, instruct network security devices such as firewalls and routers to reconfigure themselves to block certain types of activity or route it elsewhere, such as to a quarantined virtual local area network (VLAN).
Running a third-party program or script, run an administrator specified script or program when certain malicious activity is detected<br>
22
Host-Based IDPS resides on a particular computer or server, known as the host, and monitors activity only on that system.
Also known as system integrity verifiers - they benchmark and monitor the status of key system files and detect when an intruder creates, modifies, or deletes monitored files.
has an advantage over an NIDPS in that it can access encrypted information traveling over the network and use it to make decisions about potential or actual attacks.
also capable of monitoring system configuration databases, such as Windows registries, in addition to stored configuration files like .ini, .cfg, and .dat files.
work on the principle of configuration or change management, which means that they record the sizes, locations, and other attributes of system files.
triggers an alert when file attributes change, new files are created, or existing files are deleted<br>
Also known as system integrity verifiers - they benchmark and monitor the status of key system files and detect when an intruder creates, modifies, or deletes monitored files.
has an advantage over an NIDPS in that it can access encrypted information traveling over the network and use it to make decisions about potential or actual attacks.
also capable of monitoring system configuration databases, such as Windows registries, in addition to stored configuration files like .ini, .cfg, and .dat files.
work on the principle of configuration or change management, which means that they record the sizes, locations, and other attributes of system files.
triggers an alert when file attributes change, new files are created, or existing files are deleted<br>
23
HIDPS can also monitor systems logs for predefined events.
examines these files and logs to determine if an attack is under way or has occurred; it also examines whether the attack is succeeding or was successful.
classifies files into various categories and then sends notifications when changes occur.
provide only a few general levels of alert notification.
Managed HIDPSs can monitor multiple computers simultaneously by creating a configuration file on each monitored host and by making each HIDPS report back to a master console system, which is usually located on the system administrator’s computer<br>
examines these files and logs to determine if an attack is under way or has occurred; it also examines whether the attack is succeeding or was successful.
classifies files into various categories and then sends notifications when changes occur.
provide only a few general levels of alert notification.
Managed HIDPSs can monitor multiple computers simultaneously by creating a configuration file on each monitored host and by making each HIDPS report back to a master console system, which is usually located on the system administrator’s computer<br>
24
Advantages of HIDPS can detect local events on host systems and detect attacks that may elude a network-based IDPS.
functions on the host system, where encrypted traffic will be decrypted and is available for processing.
use of switched network protocols does not affect an HIDPS
can detect inconsistencies in how applications and systems programs were used by examining the records stored in audit logs, detect some types of attacks, including Trojan horse programs<br>
functions on the host system, where encrypted traffic will be decrypted and is available for processing.
use of switched network protocols does not affect an HIDPS
can detect inconsistencies in how applications and systems programs were used by examining the records stored in audit logs, detect some types of attacks, including Trojan horse programs<br>
25
Disadvantages of HIDPS pose more management issues ,requires more management effort to install, configure, and operate than a comparably sized NIDPS solution.
vulnerable both to direct attacks and to attacks against the host operating system. Either attack can result in the compromise or loss of HIDPS functionality.
not optimized to detect multihost scanning, nor is it able to detect scanning from network devices that are not hosts, such as routers or switches.
susceptible to some DoS attacks.
use large amounts of disk space to retain the host OS audit logs; (to function properly, it may be necessary to add disk capacity to the system)
inflict a performance overhead on its host systems<br>
vulnerable both to direct attacks and to attacks against the host operating system. Either attack can result in the compromise or loss of HIDPS functionality.
not optimized to detect multihost scanning, nor is it able to detect scanning from network devices that are not hosts, such as routers or switches.
susceptible to some DoS attacks.
use large amounts of disk space to retain the host OS audit logs; (to function properly, it may be necessary to add disk capacity to the system)
inflict a performance overhead on its host systems<br>
26
IDPS Detection Methods signature-based detection
anomaly-based detection
stateful protocolanalysis.<br>
anomaly-based detection
stateful protocolanalysis.<br>
27
Signature-Based Detection knowledge-based detection or misuse detection
examines network traffic in search of patterns that match known signatures - that is, preconfigured, predetermined attack patterns.
widely used because many attacks have clear and distinct signatures<br>
examines network traffic in search of patterns that match known signatures - that is, preconfigured, predetermined attack patterns.
widely used because many attacks have clear and distinct signatures<br>
28
Signature Based Detection Footprinting and fingerprinting activities use ICMP, DNS querying, and e-mail routing analysis.
Exploits use a specific attack sequence designed to take advantage of a vulnerability to gain access to a system.
DoS and DDoS attacks, during which the attacker tries to prevent the normal usage of a system, overload the system with requests so that its ability to process them efficiently is compromised or disrupted<br>
Exploits use a specific attack sequence designed to take advantage of a vulnerability to gain access to a system.
DoS and DDoS attacks, during which the attacker tries to prevent the normal usage of a system, overload the system with requests so that its ability to process them efficiently is compromised or disrupted<br>
29
Signature Based Detection new attack patterns must continually be added to the IDPS’s database of signatures; otherwise, attacks that use new strategies will not be recognized and might succeed.
Another weakness - a slow, methodical attack involving multiple events might escape detection.
The only way to resolve this vulnerability is to collect and analyze data over longer periods of time, a process that requires substantially greater data storage capability and additional processing capacity<br>
Another weakness - a slow, methodical attack involving multiple events might escape detection.
The only way to resolve this vulnerability is to collect and analyze data over longer periods of time, a process that requires substantially greater data storage capability and additional processing capacity<br>
30
Anomaly-Based Detection behavior-based detection
collects statistical summaries by observing traffic that is known to be normal, normal period of evaluation establishes a performance baseline over a period of time known as the training period.
the IDPS periodically samples network activity and uses statistical methods to compare the sampled activity to the baseline.
When the measured activity is outside the baseline parameters—exceeding what is called the clipping level—the IDPS sends an alert to the administrator.
The baseline data can include variables such as host memory or CPU usage, network packet types, and packet quantities.
profiles compiled by an anomaly-based detection - either static or dynamic.
Static profiles do not change until modified or recalibrated by an administrator.
Dynamic profiles periodically collect additional observations on data and traffic patterns and then use that information to update their baselines<br>
collects statistical summaries by observing traffic that is known to be normal, normal period of evaluation establishes a performance baseline over a period of time known as the training period.
the IDPS periodically samples network activity and uses statistical methods to compare the sampled activity to the baseline.
When the measured activity is outside the baseline parameters—exceeding what is called the clipping level—the IDPS sends an alert to the administrator.
The baseline data can include variables such as host memory or CPU usage, network packet types, and packet quantities.
profiles compiled by an anomaly-based detection - either static or dynamic.
Static profiles do not change until modified or recalibrated by an administrator.
Dynamic profiles periodically collect additional observations on data and traffic patterns and then use that information to update their baselines<br>
31
Anomaly-Based Detection Advantage - can detect new types of attacks because it looks for abnormal activity of any type.
Drawback- require much more overhead and processing capacity because they must constantly compare patterns of activity against the baseline.
Another drawback - may not detect minor changes to system variables and may generate many false positives.<br>
Drawback- require much more overhead and processing capacity because they must constantly compare patterns of activity against the baseline.
Another drawback - may not detect minor changes to system variables and may generate many false positives.<br>
32
Stateful Protocol Analysis stateful inspection firewalls track each network connection between internal and external systems using a state table to record which station sent which packet and when.
SPA - An IDPS extension of this concept
uses the opposite of a signature approach.
system compares known normal or benign protocol profiles against observed traffic.
profiles are developed and provided by the protocol vendors.
IDPS knows how a protocol such as FTP is supposed to work, and therefore can detect anomalous behavior.
By storing relevant data detected in a session and then using it to identify intrusions that involve multiple requests and responses, the IDPS can better detect specialized, multisession attacks - deep packet inspection because closely examines packets at the application layer for information that indicates a possible intrusion.<br>
SPA - An IDPS extension of this concept
uses the opposite of a signature approach.
system compares known normal or benign protocol profiles against observed traffic.
profiles are developed and provided by the protocol vendors.
IDPS knows how a protocol such as FTP is supposed to work, and therefore can detect anomalous behavior.
By storing relevant data detected in a session and then using it to identify intrusions that involve multiple requests and responses, the IDPS can better detect specialized, multisession attacks - deep packet inspection because closely examines packets at the application layer for information that indicates a possible intrusion.<br>
33
Stateful Protocol Analysis examine authentication sessions for suspicious activity as well as for attacks that incorporate unusual commands - out of sequence or submitted repeatedly.
also detect intentionally malformed commands or commands that are outside the expected length parameters
Drawbacks - analytical complexity of session-based assessments , requires heavy processing overhead to track multiple simultaneous connections, unless a protocol violates its fundamental behavior, completely fail to detect an intrusion, actually interfere with the normal operations of the protocol it is examining.<br>
also detect intentionally malformed commands or commands that are outside the expected length parameters
Drawbacks - analytical complexity of session-based assessments , requires heavy processing overhead to track multiple simultaneous connections, unless a protocol violates its fundamental behavior, completely fail to detect an intrusion, actually interfere with the normal operations of the protocol it is examining.<br>
34
Log File Monitor (LFM) similar to an NIDPS. Using an LFM, the system reviews the log files generated by servers, network devices, and even other IDPSs, looking for patterns and signatures that may indicate an attack or intrusion is in process or has already occurred.
look at multiple log files from different systems.
Requires considerable resources because it involves the collection, movement, storage, and analysis of very large quantities of log data.<br>
look at multiple log files from different systems.
Requires considerable resources because it involves the collection, movement, storage, and analysis of very large quantities of log data.<br>
35
Strengths of Intrusion Detection and Prevention Systems Monitoring and analysis of system events and user behaviors
Testing the security states of system configurations
Baselining the security state of a system, then tracking any changes to that baseline
Recognizing patterns of system events that correspond to known attacks
Recognizing patterns of activity that statistically vary from normal activity
Managing operating system audit and logging mechanisms and the data they generate
Alerting appropriate staff by appropriate means when attacks are detected
Measuring enforcement of security policies encoded in the analysis engine
Providing default information security policies
Allowing people who are not security experts to perform important security monitoring functions<br>
Testing the security states of system configurations
Baselining the security state of a system, then tracking any changes to that baseline
Recognizing patterns of system events that correspond to known attacks
Recognizing patterns of activity that statistically vary from normal activity
Managing operating system audit and logging mechanisms and the data they generate
Alerting appropriate staff by appropriate means when attacks are detected
Measuring enforcement of security policies encoded in the analysis engine
Providing default information security policies
Allowing people who are not security experts to perform important security monitoring functions<br>
36
Limitations of Intrusion Detection and Prevention Systems Compensating for weak or missing security mechanisms in the protection infrastructure - firewalls, identification and authentication systems, link encryption systems, access control mechanisms ,virus detection and eradication software
Instantaneously detecting, reporting, and responding to an attack – under heavy network or processing load
Detecting newly published attacks or variants of existing attacks
Effectively responding to attacks launched by sophisticated attackers
Automatically investigating attacks without human intervention
Resisting all attacks intended to defeat or circumvent them
Compensating problems with the fidelity of information sources
Dealing effectively with switched networks<br>
Instantaneously detecting, reporting, and responding to an attack – under heavy network or processing load
Detecting newly published attacks or variants of existing attacks
Effectively responding to attacks launched by sophisticated attackers
Automatically investigating attacks without human intervention
Resisting all attacks intended to defeat or circumvent them
Compensating problems with the fidelity of information sources
Dealing effectively with switched networks<br>
37
Honeypots, Honeynets class of powerful security tools that go beyond routine intrusion detection
Honeypots - decoy systems designed to lure potential attackers away from critical systems, also known as decoys, lures, and flytraps.
Honeynet - several honeypot systems are connected together on a network segment.<br>
Honeypots - decoy systems designed to lure potential attackers away from critical systems, also known as decoys, lures, and flytraps.
Honeynet - several honeypot systems are connected together on a network segment.<br>
38
Honeypots Divert an attacker from critical systems.
Collect information about the attacker’s activity.
Encourage the attacker to stay on the system long enough for administrators to document the event and respond.
are outfitted with sensitive monitors and event loggers that detect attempts to access the system and collect information about the potential attacker’s activities.
simple IDPS that specializes in honeypot techniques – Deception Toolkit<br>
Collect information about the attacker’s activity.
Encourage the attacker to stay on the system long enough for administrators to document the event and respond.
are outfitted with sensitive monitors and event loggers that detect attempts to access the system and collect information about the potential attacker’s activities.
simple IDPS that specializes in honeypot techniques – Deception Toolkit<br>
39
Padded Cell System hardened honeypot, operates in tandem with a traditional IDPS
detects the attackers, and then the padded cell system seamlessly transfers them to a special simulated environment – no harm<br>
detects the attackers, and then the padded cell system seamlessly transfers them to a special simulated environment – no harm<br>
40
Advantages Attackers can be diverted to targets that they cannot damage.
Administrators have time to decide how to respond to an attacker.
Attackers’ actions can be easily and more extensively monitored, and the records can be used to refine threat models and improve system protections.
Honeypots may be effective at catching insiders who are snooping around a network<br>
Administrators have time to decide how to respond to an attacker.
Attackers’ actions can be easily and more extensively monitored, and the records can be used to refine threat models and improve system protections.
Honeypots may be effective at catching insiders who are snooping around a network<br>
41
Disadvantages The legal implications of using such devices are not well understood.
Honeypots and padded cells have not yet been shown to be generally useful security technologies.
An expert attacker, once diverted into a decoy system, may become angry and launch a more aggressive attack against an organization’s systems.
Administrators and security managers need a high level of expertise to use these systems.<br>
Honeypots and padded cells have not yet been shown to be generally useful security technologies.
An expert attacker, once diverted into a decoy system, may become angry and launch a more aggressive attack against an organization’s systems.
Administrators and security managers need a high level of expertise to use these systems.<br>