Cyberstudy
PDF p.137 In progress

Intrusion Detection Systems

Open PDF at p.137 15 flashcards

Summary

PDF p.137

Intrusion detection systems (IDS) and intrusion prevention systems (IPS) perform real-time analysis of network traffic or system logs to identify and respond to malicious activities. IDS passively monitors and logs suspicious activities, while IPS actively responds to threats by blocking or redirecting traffic.

In plain words

Supplementary — not from your PDF

An IDS watches traffic (fed by a sensor on a SPAN or TAP) and matches it against signatures or behaviour patterns. It raises alerts and logs but doesn't block. An IPS sits inline and can respond automatically: shunning (blocking the source), resetting the connection, or redirecting traffic to a honeypot. Common tools are Snort, Suricata and Zeek.

Detailed explanation

PDF p.137
  • Sensors
    • Function: Capture traffic via a packet sniffer.
    • Methods: Use SPAN/mirror port or inline TAP.
    • Placement: Typically behind a firewall or near important servers.
    • Deployment: Limited number of sensors to monitor key assets or network paths.
  • Intrusion Detection Systems (IDS)
    • Traffic Analysis: Captured traffic is analyzed by IDS software (e.g., Snort, Suricata, Zeek/Bro).
    • Detection: Matches traffic against detection signatures or heuristic patterns.
    • Response: Raises alerts or generates log entries without blocking the source host.
    • Usage: Identifies and logs hosts, applications, and detects various attacks (e.g., password-guessing, port scans, worms).
  • Intrusion Prevention Systems (IPS)
    • Active Response: Capable of automatically responding to detected threats.
    • Responses
      • Shunning: Block the source of noncompliant traffic.
      • Connection Reset: Reset the connection without blocking the source address.
      • Traffic Redirection: Redirect traffic to a honeypot or honeynet for analysis.
    • Deployment: Inline appliance with integrated firewall and routing/forwarding capability.
    • Integration: Can reconfigure other appliances (e.g., firewall, router) using scripts or APIs.

Important terms

taken from the text above
Placement
Typically behind a firewall or near important servers.
Deployment
Limited number of sensors to monitor key assets or network paths.
Traffic Analysis
Captured traffic is analyzed by IDS software (e.g., Snort, Suricata, Zeek/Bro).
Active Response
Capable of automatically responding to detected threats.
Shunning
Block the source of noncompliant traffic.
Connection Reset
Reset the connection without blocking the source address.
Traffic Redirection
Redirect traffic to a honeypot or honeynet for analysis.
IDS Intrusion detection systems IPS Intrusion Prevention Systems

Examples & real-world scenarios

Supplementary — not from your PDF
  • Snort raising an alert on a known malicious pattern.
  • An IPS resetting a suspicious session.
  • An IPS updating a firewall rule through an API.

Scenario

An organization is worried that false positives could block real customers. It starts with IDS (alert-only) mode, tunes the rules, and only then switches to IPS blocking.

Common mistakes

Supplementary — not from your PDF
  • Saying an IDS blocks traffic. Only an IPS responds automatically.
  • Placing sensors everywhere. The guide notes sensors are usually limited to key assets and paths.

Practical skills

Supplementary — not from your PDF
  • Compare IDS and IPS responses.
  • Decide where to place a sensor.

What I should remember

Key Points PDF p.137
  • Sensors
    • Capture Traffic: Packet sniffer, SPAN/mirror port, inline TAP.
    • Placement: Behind firewall, near important servers.
    • Deployment: Limited sensors for key assets.
  • Intrusion Detection Systems (IDS)
    • Traffic Analysis: IDS software (Snort, Suricata, Zeek/Bro).
    • Detection: Signatures, heuristic patterns.
    • Response: Alerts, log entries, no blocking.
    • Usage: Logs hosts, applications, detects attacks.
  • Intrusion Prevention Systems (IPS)
    • Active Response: Automatic threat response.
    • Responses: Shunning, connection reset, traffic redirection.
    • Deployment: Inline appliance, integrated firewall.
    • Integration: Reconfigure appliances via scripts/APIs.