1 1 00:00:00,270 --> 00:00:01,170 In this lesson, 2 2 00:00:01,170 --> 00:00:03,570 we're going to talk about about intrusion detection system 3 3 00:00:03,570 --> 00:00:06,960 and intrusion prevention system configurations. 4 4 00:00:06,960 --> 00:00:09,480 Now, first, let's talk about what an IDS is 5 5 00:00:09,480 --> 00:00:11,700 or an intrusion detection system. 6 6 00:00:11,700 --> 00:00:14,700 This is a software or hardware system that scans, 7 7 00:00:14,700 --> 00:00:17,220 audits, and monitors the security infrastructure 8 8 00:00:17,220 --> 00:00:19,050 for signs of an attack. 9 9 00:00:19,050 --> 00:00:20,820 Now, essentially, this is going to be a device 10 10 00:00:20,820 --> 00:00:23,190 that has a packet sniffer, which we call a sensor, 11 11 00:00:23,190 --> 00:00:25,800 and it's going to read all those packets off the network, 12 12 00:00:25,800 --> 00:00:28,440 and then it's going to connect that to an analysis engine. 13 13 00:00:28,440 --> 00:00:30,870 That analysis engine is going to use a rule set 14 14 00:00:30,870 --> 00:00:32,820 to match the different traffic it sees 15 15 00:00:32,820 --> 00:00:34,980 and generate event logs, notifications, 16 16 00:00:34,980 --> 00:00:37,710 or alerts if they match their rule sets. 17 17 00:00:37,710 --> 00:00:40,140 Typically, you have to place your IDS sensor 18 18 00:00:40,140 --> 00:00:42,480 inside your firewall or close to some server 19 19 00:00:42,480 --> 00:00:44,070 that you're really trying to protect here. 20 20 00:00:44,070 --> 00:00:46,560 Now, again, these aren't going to protect them, though. 21 21 00:00:46,560 --> 00:00:48,660 They're only going to detect bad things, 22 22 00:00:48,660 --> 00:00:51,930 so, basically, it's a big machine to do logging for you. 23 23 00:00:51,930 --> 00:00:53,280 Now in a switched environment, 24 24 00:00:53,280 --> 00:00:54,570 we've talked about this before, 25 25 00:00:54,570 --> 00:00:57,840 you have to use a SPAN port, or a mirror port, or a tap. 26 26 00:00:57,840 --> 00:01:00,240 Here, on the screen, you can see a standard topology 27 27 00:01:00,240 --> 00:01:01,710 of a corporate network. 28 28 00:01:01,710 --> 00:01:03,390 Notice where we have those two taps. 29 29 00:01:03,390 --> 00:01:05,430 We have one in front of the DMZ Edge, 30 30 00:01:05,430 --> 00:01:06,960 which is where the corporate internet access 31 31 00:01:06,960 --> 00:01:09,480 is going to happen, and the other one on the Extranet, 32 32 00:01:09,480 --> 00:01:11,160 which is any kind of exteriorial connection 33 33 00:01:11,160 --> 00:01:13,050 that we're going to have to our network. 34 34 00:01:13,050 --> 00:01:14,550 Both those are good places to have it 35 35 00:01:14,550 --> 00:01:16,530 because that is the exterior boundary 36 36 00:01:16,530 --> 00:01:19,590 of our corporate network going outside of our network 37 37 00:01:19,590 --> 00:01:22,980 into someplace that's untrusted, like a DMZ or the internet. 38 38 00:01:22,980 --> 00:01:24,360 Now those taps then feedback 39 39 00:01:24,360 --> 00:01:26,070 to our security monitoring tools. 40 40 00:01:26,070 --> 00:01:27,600 In these security monitoring tools, 41 41 00:01:27,600 --> 00:01:30,360 that is where we're going to have our IDS system. 42 42 00:01:30,360 --> 00:01:33,060 So all the data's coming back from those network taps 43 43 00:01:33,060 --> 00:01:36,510 into the IDS box for analysis and logging. 44 44 00:01:36,510 --> 00:01:39,587 Now for using switch networks, like you see VLAN310 45 45 00:01:39,587 --> 00:01:43,260 and VLAN320, those can actually have a SPAN port enabled 46 46 00:01:43,260 --> 00:01:45,420 or a port mirror, and those will go back into 47 47 00:01:45,420 --> 00:01:48,960 the security monitoring system too, again, into our IDS. 48 48 00:01:48,960 --> 00:01:51,420 Both these are valid ways to get that information 49 49 00:01:51,420 --> 00:01:55,200 back to the IDS because your IDS has to get the information 50 50 00:01:55,200 --> 00:01:58,110 from the network and get that network packets in there 51 51 00:01:58,110 --> 00:01:59,340 so it can do the censoring 52 52 00:01:59,340 --> 00:02:01,590 and then feed it into its analysis engine. 53 53 00:02:01,590 --> 00:02:03,450 Now I mentioned at the beginning of this lesson 54 54 00:02:03,450 --> 00:02:06,210 we were going to talk about IDS and IPS. 55 55 00:02:06,210 --> 00:02:09,150 What is the difference between an IDS and an IPS? 56 56 00:02:09,150 --> 00:02:13,560 Well, an IPS is an IDS that can actively block an attack. 57 57 00:02:13,560 --> 00:02:14,760 As I just said, 58 58 00:02:14,760 --> 00:02:16,950 when you're dealing with an intrusion detection system, 59 59 00:02:16,950 --> 00:02:20,280 you can detect and log, but you can't stop it. 60 60 00:02:20,280 --> 00:02:22,080 For that, you need an IPS, 61 61 00:02:22,080 --> 00:02:24,510 which is an intrusion prevention system. 62 62 00:02:24,510 --> 00:02:27,240 This is a software or hardware system that scans, 63 63 00:02:27,240 --> 00:02:29,640 audits, and monitors the security infrastructure 64 64 00:02:29,640 --> 00:02:31,500 for signs of an attack in progress. 65 65 00:02:31,500 --> 00:02:33,600 That part is just like an IDS, 66 66 00:02:33,600 --> 00:02:36,750 and then it can actively block the attack. 67 67 00:02:36,750 --> 00:02:38,610 Now the way an IPS does this 68 68 00:02:38,610 --> 00:02:41,400 is it's based on rule sets just like an IDS. 69 69 00:02:41,400 --> 00:02:43,710 And for high-priority events, you can configure them 70 70 00:02:43,710 --> 00:02:45,810 to actually perform a blocking action, 71 71 00:02:45,810 --> 00:02:48,480 or you can run all the traffic through the IPS, 72 72 00:02:48,480 --> 00:02:50,610 which is called an inline IPS, 73 73 00:02:50,610 --> 00:02:52,140 and that way any traffic that comes through 74 74 00:02:52,140 --> 00:02:54,000 that matches the rule set that needs to be blocked 75 75 00:02:54,000 --> 00:02:56,430 can be blocked by the IPS itself. 76 76 00:02:56,430 --> 00:02:58,380 Now an IPS can also run different scripts 77 77 00:02:58,380 --> 00:03:00,180 in third-party programs to be able to perform 78 78 00:03:00,180 --> 00:03:02,910 some other kind of action that may not just be blocking. 79 79 00:03:02,910 --> 00:03:04,980 Maybe it's logging and alerting. 80 80 00:03:04,980 --> 00:03:07,290 Maybe it is logging, alerting, and blocking, 81 81 00:03:07,290 --> 00:03:09,030 or something else that needs to be done. 82 82 00:03:09,030 --> 00:03:12,330 All this can be configured inside the IPS software itself. 83 83 00:03:12,330 --> 00:03:15,480 Now when it comes to software, most IDS software 84 84 00:03:15,480 --> 00:03:18,600 can be configured as an IDS or an IPS, 85 85 00:03:18,600 --> 00:03:20,850 and there are three common ones we're going to talk about. 86 86 00:03:20,850 --> 00:03:24,270 We have Snort, Zeek, and the Security Onion. 87 87 00:03:24,270 --> 00:03:26,940 Now Snort is an open-source software that's available 88 88 00:03:26,940 --> 00:03:29,640 for Windows and selected Linux distribution, 89 89 00:03:29,640 --> 00:03:32,760 and it can operate as either an IDS or an IPS 90 90 00:03:32,760 --> 00:03:34,620 depending on the mode you want. 91 91 00:03:34,620 --> 00:03:37,320 Now when you install Snort, you have to have signatures 92 92 00:03:37,320 --> 00:03:39,540 so it knows what to block and what to log, 93 93 00:03:39,540 --> 00:03:42,360 and it does this by using what's called Oinkcode. 94 94 00:03:42,360 --> 00:03:44,070 Now Oinkcode is something you have to sign up for 95 95 00:03:44,070 --> 00:03:45,300 with a subscription model, 96 96 00:03:45,300 --> 00:03:48,180 and you actually pay for these up-to-date data rule sets. 97 97 00:03:48,180 --> 00:03:50,880 This will give you all the latest security threats. 98 98 00:03:50,880 --> 00:03:52,710 Now if you are a non-subscriber 99 99 00:03:52,710 --> 00:03:54,450 and you don't pay for the Oinkcode, 100 100 00:03:54,450 --> 00:03:57,150 you can actually get community-authored rule sets, 101 101 00:03:57,150 --> 00:03:58,170 which are still good, 102 102 00:03:58,170 --> 00:03:59,700 but they're not going to be nearly as up to date 103 103 00:03:59,700 --> 00:04:02,310 as the published commercial version of Oinkcode. 104 104 00:04:02,310 --> 00:04:05,010 Now Snort can allow you to operate both in a sniffer mode 105 105 00:04:05,010 --> 00:04:07,710 or a log-only mode, which would be a detection mode, 106 106 00:04:07,710 --> 00:04:09,600 or at an active response mode, 107 107 00:04:09,600 --> 00:04:11,460 which would be a prevention mode. 108 108 00:04:11,460 --> 00:04:13,980 Either way, it works really, really well. 109 109 00:04:13,980 --> 00:04:16,380 Snort is one of these free open-source programs, 110 110 00:04:16,380 --> 00:04:18,000 and it's a great thing to get started with 111 111 00:04:18,000 --> 00:04:19,830 if you want to set this up on your own network, 112 112 00:04:19,830 --> 00:04:22,860 set up some basic data rules from the free community set 113 113 00:04:22,860 --> 00:04:24,180 and see how it works. 114 114 00:04:24,180 --> 00:04:26,250 The next one we're going to talk about is Zeek. 115 115 00:04:26,250 --> 00:04:28,410 Now Zeek was formally called Bro, 116 116 00:04:28,410 --> 00:04:32,670 and Zeek is an open-source IDS for Unix and Linux platforms. 117 117 00:04:32,670 --> 00:04:34,230 It's going to contain a scripting engine 118 118 00:04:34,230 --> 00:04:36,330 which can be used to act on significant events, 119 119 00:04:36,330 --> 00:04:39,000 which we called notices, by generating an alert 120 120 00:04:39,000 --> 00:04:42,030 and implementing some sort of shunning mechanism. 121 121 00:04:42,030 --> 00:04:45,870 So, again, this can operate either as an IDS or an IPS 122 122 00:04:45,870 --> 00:04:47,670 depending on how you configure it. 123 123 00:04:47,670 --> 00:04:49,860 Now here on the screen, you can see an example 124 124 00:04:49,860 --> 00:04:52,980 of a rule set for the Zeek monitoring tool. 125 125 00:04:52,980 --> 00:04:55,650 Now, again, for the exam, you do not need to memorize 126 126 00:04:55,650 --> 00:04:57,750 what this looks like or how to write one. 127 127 00:04:57,750 --> 00:04:59,130 I just wanted to show it to you 128 128 00:04:59,130 --> 00:05:00,900 so you can see what these things look like. 129 129 00:05:00,900 --> 00:05:02,340 If you want to take a closer look, 130 130 00:05:02,340 --> 00:05:04,830 go ahead and hit pause and take a look at this now. 131 131 00:05:04,830 --> 00:05:06,600 Alright, the next thing we're going to talk about 132 132 00:05:06,600 --> 00:05:08,850 is Security Onion, and this is our third tool 133 133 00:05:08,850 --> 00:05:10,170 we're going to talk about. 134 134 00:05:10,170 --> 00:05:13,140 Security Onion is an open-source Linux-based platform 135 135 00:05:13,140 --> 00:05:15,390 for security monitoring, incident response, 136 136 00:05:15,390 --> 00:05:17,460 and threat hunting, and it bundles together 137 137 00:05:17,460 --> 00:05:19,530 a lot of different tools like Snort, 138 138 00:05:19,530 --> 00:05:20,880 which we just talked about, 139 139 00:05:20,880 --> 00:05:23,640 Suricata, Zeek, which we just talked about, 140 140 00:05:23,640 --> 00:05:25,470 Wireshark, which we've talked about before, 141 141 00:05:25,470 --> 00:05:28,200 and NetworkMiner, along with a bunch of other tools 142 142 00:05:28,200 --> 00:05:31,020 like Log Management and Incident Management tools. 143 143 00:05:31,020 --> 00:05:33,000 Now Security Onion, if you want to think about it 144 144 00:05:33,000 --> 00:05:35,520 like Kali Linux if you've ever done pen testing. 145 145 00:05:35,520 --> 00:05:38,400 In the pen testing world, a lot of us will use Kali Linux 146 146 00:05:38,400 --> 00:05:40,800 because Kali Linux has the ability for us 147 147 00:05:40,800 --> 00:05:43,230 to have all of our tools in one Linux distribution 148 148 00:05:43,230 --> 00:05:45,030 so we can go out and do our pen tests. 149 149 00:05:45,030 --> 00:05:47,310 Well, Security Onion is the same kind of thing, 150 150 00:05:47,310 --> 00:05:48,930 but for Network Defenders. 151 151 00:05:48,930 --> 00:05:50,640 So if you're going to be doing PenTest+, 152 152 00:05:50,640 --> 00:05:52,350 Kali is going to be one of your best friends. 153 153 00:05:52,350 --> 00:05:54,150 If you're going to be doing CySA+, 154 154 00:05:54,150 --> 00:05:56,220 Security Onion is one of your best friends. 155 155 00:05:56,220 --> 00:05:57,720 And so, again, this is one of those tools 156 156 00:05:57,720 --> 00:05:59,160 that'd be great for you to download 157 157 00:05:59,160 --> 00:06:02,130 and play with in your free time, set it up on your network, 158 158 00:06:02,130 --> 00:06:05,730 set up some free logging, set up some free IPS or IDS, 159 159 00:06:05,730 --> 00:06:08,880 and see how all this stuff works together in the real world. 160 160 00:06:08,880 --> 00:06:11,670 For the exam, you don't need to be a tool expert. 161 161 00:06:11,670 --> 00:06:14,640 No one's going to ask you how to actually use these tools, 162 162 00:06:14,640 --> 00:06:17,220 but you should be aware of what they are and what they do. 163 163 00:06:17,220 --> 00:06:19,110 Now for the real world, when you start working 164 164 00:06:19,110 --> 00:06:21,600 as a cybersecurity analyst or an incident responder, 165 165 00:06:21,600 --> 00:06:23,400 you're going to use tools like Security Onion, 166 166 00:06:23,400 --> 00:06:24,930 and Snort, and Wire Shark, 167 167 00:06:24,930 --> 00:06:27,030 and all these other tools we've been talking about. 168 168 00:06:27,030 --> 00:06:29,400 So it is a good idea to download them 169 169 00:06:29,400 --> 00:06:31,260 'cause most of them are free and open-source, 170 170 00:06:31,260 --> 00:06:33,893 and start playing with them and get comfortable with them.