Intrusion Detection and Prevention Systems (IDS/IPS)
Summary
PDF p.253IDS and IPS monitor network traffic for suspicious activities. IDS detects and alerts on potential threats, while IPS takes proactive measures to prevent or mitigate them.
In plain words
Supplementary — not from your PDFAn IDS alerts; an IPS acts. Host-based systems (HIDS/HIPS, such as OSSEC) run on individual machines and watch logs, file integrity and system behaviour. That's good for insider threats and host-specific activity. Network-based systems (NIDS/NIPS) watch traffic across many hosts, which is good for network-wide anomalies such as DDoS. Using both gives the best coverage. Common tools are Snort, Suricata and Security Onion (a platform bundling several tools).
Detailed explanation
PDF p.253-
IDS vs. IPS
- IDS: Monitors and alerts on suspicious activities without taking action.
- IPS: Monitors, detects, and takes action to prevent threats.
Host-Based vs. Network-Based Systems
-
Host-Based IDS/IPS (HIDS/HIPS)
- Installation: On individual systems or servers.
- Monitoring: System behavior, configurations, and non-network events.
- Example: OSSEC (log analysis, integrity checking, real-time alerting).
-
Network-Based IDS/IPS (NIDS/NIPS)
- Monitoring: Network traffic for patterns or signatures of threats.
- Effectiveness: Identifies threats across multiple systems (e.g., DDoS attacks).
Complementary Use
- HIDS/HIPS: Effective for insider threats and system-specific activities.
- NIDS/NIPS: Effective for network-wide anomalies and external threats.
Examples of IDS and IPS Tools
-
Snort (IDS/IPS)
- Detection Methods: Signature, protocol, and anomaly-based inspection.
- Community Support: Large community contributing rules and configurations.
-
Suricata (IDS/IPS/NSM)
- Performance: High-performance, scalable, compatible with Snort rulesets.
-
Security Onion
- Platform: Linux distribution for intrusion detection, network security monitoring, and log management.
- Integration: Includes Snort, Suricata, and other tools for comprehensive security.
Important terms
taken from the text above- IDS
- Monitors and alerts on suspicious activities without taking action.
- IPS
- Monitors, detects, and takes action to prevent threats.
- Installation
- On individual systems or servers.
- Effectiveness
- Identifies threats across multiple systems (e.g., DDoS attacks).
- HIDS/HIPS
- Effective for insider threats and system-specific activities.
- NIDS/NIPS
- Effective for network-wide anomalies and external threats.
- Detection Methods
- Signature, protocol, and anomaly-based inspection.
- Community Support
- Large community contributing rules and configurations.
- Performance
- High-performance, scalable, compatible with Snort rulesets.
- Platform
- Linux distribution for intrusion detection, network security monitoring, and log management.
Examples & real-world scenarios
Supplementary — not from your PDF- OSSEC alerting when a system file changes.
- Suricata inspecting traffic at the network edge.
- Security Onion running in a home lab to monitor your own traffic.
Scenario
An insider copies files from a server using valid credentials. A NIDS sees normal-looking traffic, but the HIDS on the server flags unusual file access. That's why host and network sensors complement each other.
Common mistakes
Supplementary — not from your PDF- Assuming a NIDS sees activity inside encrypted sessions or on the host itself.
- Mixing up HIDS (on the host) and NIDS (on the network).
Practical skills
Supplementary — not from your PDF- Choose HIDS or NIDS placement for a scenario.
- Set up Security Onion in an isolated lab to watch your own lab traffic.
What I should remember
Key Points PDF p.253-
IDS
- Passive Monitoring: Inspects traffic, identifies threats, sends alerts.
- No Blocking: Does not prevent threats, avoids false positives blocking legitimate traffic.
-
IPS
- Proactive Measures: Blocks traffic, drops malicious packets, resets connections.
- Risk of False Positives: Potential to block legitimate traffic.