Instructor: In this lesson, 2 2
we're going to talk about about intrusion detection system 3 3
and intrusion prevention system configurations. 4 4
Now, first, let's talk about what an IDS is 5 5
or an intrusion detection system. 6 6
This is a software or hardware system that scans, 7 7
audits, and monitors the security infrastructure 8 8
for signs of an attack. 9 9
Now, essentially, this is going to be a device 10 10
that has a packet sniffer, which we call a sensor, 11 11
and it's going to read all those packets off the network, 12 12
and then it's going to connect that to an analysis engine. 13 13
That analysis engine is going to use a rule set 14 14
to match the different traffic it sees 15 15
and generate event logs, notifications, 16 16
or alerts if they match their rule sets. 17 17
Typically, you have to place your IDS sensor 18 18
inside your firewall or close to some server 19 19
that you're really trying to protect here. 20 20
Now, again, these aren't going to protect them, though. 21 21
They're only going to detect bad things, 22 22
so, basically, it's a big machine to do logging for you. 23 23
Now in a switched environment, 24 24
we've talked about this before, 25 25
you have to use a SPAN port, or a mirror port, or a tap. 26 26
Here, on the screen, you can see a standard topology 27 27
of a corporate network. 28 28
Notice where we have those two taps. 29 29
We have one in front of the DMZ Edge, 30 30
which is where the corporate internet access 31 31
is going to happen, and the other one on the Extranet, 32 32
which is any kind of exteriorial connection 33 33
that we're going to have to our network. 34 34
Both those are good places to have it 35 35
because that is the exterior boundary 36 36
of our corporate network going outside of our network 37 37
into someplace that's untrusted, like a DMZ or the internet. 38 38
Now those taps then feedback 39 39
to our security monitoring tools. 40 40
In these security monitoring tools, 41 41
that is where we're going to have our IDS system. 42 42
So all the data's coming back from those network taps 43 43
into the IDS box for analysis and logging. 44 44
Now for using switch networks, like you see VLAN310 45 45
and VLAN320, those can actually have a SPAN port enabled 46 46
or a port mirror, and those will go back into 47 47
the security monitoring system too, again, into our IDS. 48 48
Both these are valid ways to get that information 49 49
back to the IDS because your IDS has to get the information 50 50
from the network and get that network packets in there 51 51
so it can do the censoring 52 52
and then feed it into its analysis engine. 53 53
Now I mentioned at the beginning of this lesson 54 54
we were going to talk about IDS and IPS. 55 55
What is the difference between an IDS and an IPS? 56 56
Well, an IPS is an IDS that can actively block an attack. 57 57
As I just said, 58 58
when you're dealing with an intrusion detection system, 59 59
you can detect and log, but you can't stop it. 60 60
For that, you need an IPS, 61 61
which is an intrusion prevention system. 62 62
This is a software or hardware system that scans, 63 63
audits, and monitors the security infrastructure 64 64
for signs of an attack in progress. 65 65
That part is just like an IDS, 66 66
and then it can actively block the attack. 67 67
Now the way an IPS does this 68 68
is it's based on rule sets just like an IDS. 69 69
And for high-priority events, you can configure them 70 70
to actually perform a blocking action, 71 71
or you can run all the traffic through the IPS, 72 72
which is called an inline IPS, 73 73
and that way any traffic that comes through 74 74
that matches the rule set that needs to be blocked 75 75
can be blocked by the IPS itself. 76 76
Now an IPS can also run different scripts 77 77
in third-party programs to be able to perform 78 78
some other kind of action that may not just be blocking. 79 79
Maybe it's logging and alerting. 80 80
Maybe it is logging, alerting, and blocking, 81 81
or something else that needs to be done. 82 82
All this can be configured inside the IPS software itself. 83 83
Now when it comes to software, most IDS software 84 84
can be configured as an IDS or an IPS, 85 85
and there are three common ones we're going to talk about. 86 86
We have Snort, Zeek, and the Security Onion. 87 87
Now Snort is an open-source software that's available 88 88
for Windows and selected Linux distribution, 89 89
and it can operate as either an IDS or an IPS 90 90
depending on the mode you want. 91 91
Now when you install Snort, you have to have signatures 92 92
so it knows what to block and what to log, 93 93
and it does this by using what's called Oinkcode. 94 94
Now Oinkcode is something you have to sign up for 95 95
with a subscription model, 96 96
and you actually pay for these up-to-date data rule sets. 97 97
This will give you all the latest security threats. 98 98
Now if you are a non-subscriber 99 99
and you don't pay for the Oinkcode, 100 100
you can actually get community-authored rule sets, 101 101
which are still good, 102 102
but they're not going to be nearly as up to date 103 103
as the published commercial version of Oinkcode. 104 104
Now Snort can allow you to operate both in a sniffer mode 105 105
or a log-only mode, which would be a detection mode, 106 106
or at an active response mode, 107 107
which would be a prevention mode. 108 108
Either way, it works really, really well. 109 109
Snort is one of these free open-source programs, 110 110
and it's a great thing to get started with 111 111
if you want to set this up on your own network, 112 112
set up some basic data rules from the free community set 113 113
and see how it works. 114 114
The next one we're going to talk about is Zeek. 115 115
Now Zeek was formally called Bro, 116 116
and Zeek is an open-source IDS for Unix and Linux platforms. 117 117
It's going to contain a scripting engine 118 118
which can be used to act on significant events, 119 119
which we called notices, by generating an alert 120 120
and implementing some sort of shunning mechanism. 121 121
So, again, this can operate either as an IDS or an IPS 122 122
depending on how you configure it. 123 123
Now here on the screen, you can see an example 124 124
of a rule set for the Zeek monitoring tool. 125 125
Now, again, for the exam, you do not need to memorize 126 126
what this looks like or how to write one. 127 127
I just wanted to show it to you 128 128
so you can see what these things look like. 129 129
If you want to take a closer look, 130 130
go ahead and hit pause and take a look at this now. 131 131
Alright, the next thing we're going to talk about 132 132
is Security Onion, and this is our third tool 133 133
we're going to talk about. 134 134
Security Onion is an open-source Linux-based platform 135 135
for security monitoring, incident response, 136 136
and threat hunting, and it bundles together 137 137
a lot of different tools like Snort, 138 138
which we just talked about, 139 139
Suricata, Zeek, which we just talked about, 140 140
Wireshark, which we've talked about before, 141 141
and NetworkMiner, along with a bunch of other tools 142 142
like Log Management and Incident Management tools. 143 143
Now Security Onion, if you want to think about it 144 144
like Kali Linux if you've ever done pen testing. 145 145
In the pen testing world, a lot of us will use Kali Linux 146 146
because Kali Linux has the ability for us 147 147
to have all of our tools in one Linux distribution 148 148
so we can go out and do our pen tests. 149 149
Well, Security Onion is the same kind of thing, 150 150
but for Network Defenders. 151 151
So if you're going to be doing PenTest+, 152 152
Kali is going to be one of your best friends. 153 153
If you're going to be doing CySA+, 154 154
Security Onion is one of your best friends. 155 155
And so, again, this is one of those tools 156 156
that'd be great for you to download 157 157
and play with in your free time, set it up on your network, 158 158
set up some free logging, set up some free IPS or IDS, 159 159
and see how all this stuff works together in the real world. 160 160
For the exam, you don't need to be a tool expert. 161 161
No one's going to ask you how to actually use these tools, 162 162
but you should be aware of what they are and what they do. 163 163
Now for the real world, when you start working 164 164
as a cybersecurity analyst or an incident responder, 165 165
you're going to use tools like Security Onion, 166 166
and Snort, and Wire Shark, 167 167
and all these other tools we've been talking about. 168 168
So it is a good idea to download them 169 169
'cause most of them are free and open-source, 170 170
and start playing with them and get comfortable with them.