1 1 00:00:00,780 --> 00:00:04,110 Intrusion detection and intrusion protection systems. 2 2 00:00:04,110 --> 00:00:05,570 Now, in this lesson, we're going to talk 3 3 00:00:05,570 --> 00:00:07,870 about IDSs and IPSs. 4 4 00:00:07,870 --> 00:00:09,320 We've mentioned them briefly before 5 5 00:00:09,320 --> 00:00:11,140 but now, we're going to dig into them. 6 6 00:00:11,140 --> 00:00:14,200 Now, when we talk about IDS or intrusion detection system, 7 7 00:00:14,200 --> 00:00:16,770 or IPS, an intrusion prevention system, 8 8 00:00:16,770 --> 00:00:18,860 these can recognize network attacks. 9 9 00:00:18,860 --> 00:00:21,230 And in the case of intrusion prevention system, 10 10 00:00:21,230 --> 00:00:23,200 they can actually respond appropriately. 11 11 00:00:23,200 --> 00:00:25,310 It's going to analyze all the incoming data 12 12 00:00:25,310 --> 00:00:27,190 for any attacks it knows about using 13 13 00:00:27,190 --> 00:00:28,640 different detection mechanisms 14 14 00:00:28,640 --> 00:00:30,940 like a signature or behavioral-based model. 15 15 00:00:30,940 --> 00:00:32,010 And we'll talk about more of those 16 16 00:00:32,010 --> 00:00:34,000 as we go through this video, too. 17 17 00:00:34,000 --> 00:00:36,650 Now, one of the most common ones is known as Snort. 18 18 00:00:36,650 --> 00:00:39,980 S-N-O-R-T, which you can see here on the screen. 19 19 00:00:39,980 --> 00:00:42,370 Snort is a software-based intrusion detection 20 20 00:00:42,370 --> 00:00:44,060 and intrusion prevention system. 21 21 00:00:44,060 --> 00:00:47,280 It is open source and it is widely used in the industry. 22 22 00:00:47,280 --> 00:00:48,113 Now, when you're dealing 23 23 00:00:48,113 --> 00:00:49,600 with intrusion detection system, 24 24 00:00:49,600 --> 00:00:51,710 this is considered a passive device. 25 25 00:00:51,710 --> 00:00:53,740 It's going to operate in parallel to your network, 26 26 00:00:53,740 --> 00:00:55,160 and you can see it here in the diagram 27 27 00:00:55,160 --> 00:00:58,110 hanging off just below the switch in this diagram. 28 28 00:00:58,110 --> 00:00:59,670 Now, it's going to monitor all the traffic 29 29 00:00:59,670 --> 00:01:01,410 going across the network and it's going to log in. 30 30 00:01:01,410 --> 00:01:03,510 And it's going to alert any time it sees something 31 31 00:01:03,510 --> 00:01:04,790 that it thinks is bad. 32 32 00:01:04,790 --> 00:01:06,530 So, if it thinks it sees something bad, 33 33 00:01:06,530 --> 00:01:08,210 like there might be an attack going on, 34 34 00:01:08,210 --> 00:01:09,720 it might see something like a port scan 35 35 00:01:09,720 --> 00:01:11,240 or denial of service attack, 36 36 00:01:11,240 --> 00:01:12,580 or anything else that matches 37 37 00:01:12,580 --> 00:01:14,110 its database to signatures, 38 38 00:01:14,110 --> 00:01:16,460 then, it's going to alert the system administrator. 39 39 00:01:16,460 --> 00:01:18,440 But because it's a detection system, 40 40 00:01:18,440 --> 00:01:20,300 it's not going to respond. 41 41 00:01:20,300 --> 00:01:22,020 All it's going to do is log in. 42 42 00:01:22,020 --> 00:01:23,640 It might capture some packet data on it, 43 43 00:01:23,640 --> 00:01:25,200 if you configured it to do that 44 44 00:01:25,200 --> 00:01:26,390 and then, it's going to send the alert 45 45 00:01:26,390 --> 00:01:28,120 to the administrator who's going to go ahead 46 46 00:01:28,120 --> 00:01:29,650 and investigate it further. 47 47 00:01:29,650 --> 00:01:31,730 Now, on the other hand, if you have it configured 48 48 00:01:31,730 --> 00:01:33,650 as an intrusion prevention system, 49 49 00:01:33,650 --> 00:01:35,630 this is considered an active device. 50 50 00:01:35,630 --> 00:01:37,810 And so, it has to operate in-line. 51 51 00:01:37,810 --> 00:01:39,150 Notice how it's now placed here 52 52 00:01:39,150 --> 00:01:40,920 between the firewall and the switch, 53 53 00:01:40,920 --> 00:01:42,620 so all the traffic from the attacker 54 54 00:01:42,620 --> 00:01:43,560 and from the Internet 55 55 00:01:43,560 --> 00:01:45,770 has to go through this device as it goes 56 56 00:01:45,770 --> 00:01:48,290 through the router and the firewall into your network. 57 57 00:01:48,290 --> 00:01:50,970 This way, by using this intrusion prevention system, 58 58 00:01:50,970 --> 00:01:53,240 it can actually have all the data going through it 59 59 00:01:53,240 --> 00:01:55,430 and it can stop and block any data 60 60 00:01:55,430 --> 00:01:56,840 that it thinks is bad. 61 61 00:01:56,840 --> 00:01:58,100 Now, again, this is going to be based off 62 62 00:01:58,100 --> 00:02:00,180 of the signatures you have programmed. 63 63 00:02:00,180 --> 00:02:01,840 It's going to monitor all the traffic, 64 64 00:02:01,840 --> 00:02:03,980 send all the alerts, do all the logging, 65 65 00:02:03,980 --> 00:02:05,070 do the packet capture, 66 66 00:02:05,070 --> 00:02:07,260 all of the stuff like an IDS would. 67 67 00:02:07,260 --> 00:02:09,380 But because it's a prevention system, 68 68 00:02:09,380 --> 00:02:12,290 it can also drop or block offending traffic. 69 69 00:02:12,290 --> 00:02:15,340 Therefore, it can actually stop an attack in progress. 70 70 00:02:15,340 --> 00:02:17,780 Now, if you're worried about a denial of service attack, 71 71 00:02:17,780 --> 00:02:19,610 an IPS is one of the best ways 72 72 00:02:19,610 --> 00:02:21,190 to prevent this from happening. 73 73 00:02:21,190 --> 00:02:23,910 Now, why would we use an IDS versus an IPS? 74 74 00:02:23,910 --> 00:02:26,860 Cause it sounds like an IPS is awesome. 75 75 00:02:26,860 --> 00:02:29,461 Well, one of the problems is that IPSs 76 76 00:02:29,461 --> 00:02:31,970 and IDSs are not always tuned properly. 77 77 00:02:31,970 --> 00:02:33,900 And so, if you have a false positive, 78 78 00:02:33,900 --> 00:02:36,080 you can actually drop legitimate traffic 79 79 00:02:36,080 --> 00:02:37,760 if you're using an IPS. 80 80 00:02:37,760 --> 00:02:38,620 So, that's one of the reasons 81 81 00:02:38,620 --> 00:02:40,240 why a lot of organizations operate 82 82 00:02:40,240 --> 00:02:42,640 these detection systems in detection mode 83 83 00:02:42,640 --> 00:02:44,320 and not prevention mode. 84 84 00:02:44,320 --> 00:02:47,650 Speaking of detection, how can we detect different things? 85 85 00:02:47,650 --> 00:02:50,060 Well, there are really three main methods. 86 86 00:02:50,060 --> 00:02:51,800 We have signature-based detection, 87 87 00:02:51,800 --> 00:02:54,910 policy-based detection, and anomaly-based detection. 88 88 00:02:54,910 --> 00:02:56,840 When you're dealing with signature-based detection, 89 89 00:02:56,840 --> 00:02:58,190 this is where a signature contains 90 90 00:02:58,190 --> 00:03:00,230 a string of bytes that acts as a unique 91 91 00:03:00,230 --> 00:03:02,100 fingerprint or some sort of a pattern 92 92 00:03:02,100 --> 00:03:04,310 that's going to be triggering that detection. 93 93 00:03:04,310 --> 00:03:05,330 Think of it like a signature 94 94 00:03:05,330 --> 00:03:07,380 from malware or your hand signature. 95 95 00:03:07,380 --> 00:03:08,287 I can look at it and say, 96 96 00:03:08,287 --> 00:03:10,697 "Ah, I know this is John Smith's signature, 97 97 00:03:10,697 --> 00:03:11,970 I've seen it before." 98 98 00:03:11,970 --> 00:03:13,330 That's essentially what we're doing here 99 99 00:03:13,330 --> 00:03:15,150 with the data flowing through the network. 100 100 00:03:15,150 --> 00:03:17,530 Now, these signatures have to be created by yourself 101 101 00:03:17,530 --> 00:03:20,410 or you can download them from a central repository. 102 102 00:03:20,410 --> 00:03:22,490 Now, if you find a signature that matches something 103 103 00:03:22,490 --> 00:03:24,530 that isn't threatening, but you have your device 104 104 00:03:24,530 --> 00:03:26,550 in prevention mode, guess what? 105 105 00:03:26,550 --> 00:03:27,740 That's going to cause issues for you 106 106 00:03:27,740 --> 00:03:29,080 because it's going to block it. 107 107 00:03:29,080 --> 00:03:30,510 And this again is why people tend 108 108 00:03:30,510 --> 00:03:34,010 to lean towards an IDS instead of an IPS. 109 109 00:03:34,010 --> 00:03:36,220 Next, we have policy-based detection. 110 110 00:03:36,220 --> 00:03:37,710 And this is going to rely on a specific 111 111 00:03:37,710 --> 00:03:39,439 declaration of a security policy. 112 112 00:03:39,439 --> 00:03:40,977 You may say something like, 113 113 00:03:40,977 --> 00:03:42,520 "No Telnet allowed." 114 114 00:03:42,520 --> 00:03:44,910 and if we see anybody trying to talk on Port 23, 115 115 00:03:44,910 --> 00:03:46,270 we know that's a policy issue 116 116 00:03:46,270 --> 00:03:47,870 and we're going to flag it in the logs 117 117 00:03:47,870 --> 00:03:49,240 and we're going to alert on it. 118 118 00:03:49,240 --> 00:03:51,650 That's the idea of policy-based detection. 119 119 00:03:51,650 --> 00:03:54,370 Now, the third one we have is an anomaly-based detection. 120 120 00:03:54,370 --> 00:03:55,350 And this is either going to be done 121 121 00:03:55,350 --> 00:03:58,340 through a statistical or non-statistical anomaly. 122 122 00:03:58,340 --> 00:04:00,380 Now, if it's using a statistical anomaly, 123 123 00:04:00,380 --> 00:04:01,970 it's going to watch for traffic patterns 124 124 00:04:01,970 --> 00:04:04,210 and build a baseline up and then anytime it sees 125 125 00:04:04,210 --> 00:04:06,100 something that thinks is outside the normal, 126 126 00:04:06,100 --> 00:04:07,380 it's going to flag it. 127 127 00:04:07,380 --> 00:04:09,370 Again, if you're using an IPS, 128 128 00:04:09,370 --> 00:04:11,320 this can be very, very dangerous. 129 129 00:04:11,320 --> 00:04:12,900 Because something that is completely normal 130 130 00:04:12,900 --> 00:04:15,090 and routine that's just a little bit outside 131 131 00:04:15,090 --> 00:04:17,010 the normal baseline could be flagged 132 132 00:04:17,010 --> 00:04:19,010 and cause issues for your end users. 133 133 00:04:19,010 --> 00:04:21,440 Now, when you use a non-statistical anomaly, 134 134 00:04:21,440 --> 00:04:23,600 this is based on a pattern or baseline 135 135 00:04:23,600 --> 00:04:25,470 that the administrator is going to define. 136 136 00:04:25,470 --> 00:04:26,857 So, I might go in and configure and say, 137 137 00:04:26,857 --> 00:04:30,117 "Hey, anytime I see more than some amount of downloads, 138 138 00:04:30,117 --> 00:04:32,127 it's over a gigabyte per user per day, 139 139 00:04:32,127 --> 00:04:33,127 I want you to flag that 140 140 00:04:33,127 --> 00:04:35,520 because that might be something that's not right." 141 141 00:04:35,520 --> 00:04:36,353 These are the kind of things 142 142 00:04:36,353 --> 00:04:37,930 that we're going to set by the administrator 143 143 00:04:37,930 --> 00:04:40,580 and they would then be a non-statistical anomaly. 144 144 00:04:40,580 --> 00:04:42,870 In addition to having an intrusion detection system 145 145 00:04:42,870 --> 00:04:44,490 and intrusion prevention system, 146 146 00:04:44,490 --> 00:04:46,120 we could also have either host-based 147 147 00:04:46,120 --> 00:04:49,040 or network-based IDSs and IPSs. 148 148 00:04:49,040 --> 00:04:51,690 And this is another way we distinguish these systems. 149 149 00:04:51,690 --> 00:04:53,520 When we're dealing with the network-based one, 150 150 00:04:53,520 --> 00:04:54,940 we're talking about a network device 151 151 00:04:54,940 --> 00:04:57,190 that's going to protect the entire network. 152 152 00:04:57,190 --> 00:04:58,780 The diagrams I showed you earlier 153 153 00:04:58,780 --> 00:05:02,240 were example of a network-based IDS and IPS, 154 154 00:05:02,240 --> 00:05:03,600 were either hung off the switch 155 155 00:05:03,600 --> 00:05:05,880 or it was between the switch and the firewall. 156 156 00:05:05,880 --> 00:05:07,520 Now, if I wanted to have it as a software 157 157 00:05:07,520 --> 00:05:08,353 installed on the host 158 158 00:05:08,353 --> 00:05:10,240 like your Windows or your Mac machine, 159 159 00:05:10,240 --> 00:05:11,320 this would be a piece of software 160 160 00:05:11,320 --> 00:05:12,810 we install and it can serve 161 161 00:05:12,810 --> 00:05:15,090 as an IDS or an IPS, as well. 162 162 00:05:15,090 --> 00:05:16,910 Those are considered host-based 163 163 00:05:16,910 --> 00:05:19,370 because it's sitting on a host or a server. 164 164 00:05:19,370 --> 00:05:20,300 This would be your clients, 165 165 00:05:20,300 --> 00:05:22,550 your servers, your phones, your tablets. 166 166 00:05:22,550 --> 00:05:24,540 Now, these network and host-based systems 167 167 00:05:24,540 --> 00:05:27,340 can be used together to give you even more protection. 168 168 00:05:27,340 --> 00:05:29,120 For example, you might have a network 169 169 00:05:29,120 --> 00:05:31,370 intrusion prevention system that's going to be used 170 170 00:05:31,370 --> 00:05:32,540 in-line to protect you 171 171 00:05:32,540 --> 00:05:34,260 from a denial of service attack. 172 172 00:05:34,260 --> 00:05:36,220 But then, you might also have a host-based 173 173 00:05:36,220 --> 00:05:39,050 intrusion prevention system on your Windows server 174 174 00:05:39,050 --> 00:05:40,440 that can prevent people from installing 175 175 00:05:40,440 --> 00:05:43,040 and running software that you don't authorize. 176 176 00:05:43,040 --> 00:05:44,050 This is going to help protect you 177 177 00:05:44,050 --> 00:05:46,560 from malware attacks and other things like that. 178 178 00:05:46,560 --> 00:05:47,810 Now, what is all these look like 179 179 00:05:47,810 --> 00:05:49,000 when you put it together? 180 180 00:05:49,000 --> 00:05:51,080 Well, it looks kind of like this. 181 181 00:05:51,080 --> 00:05:52,470 Notice here, I have two switches 182 182 00:05:52,470 --> 00:05:53,790 hanging off that router. 183 183 00:05:53,790 --> 00:05:56,210 I have my administrative and my management network. 184 184 00:05:56,210 --> 00:05:57,780 And I also have my users who are sitting 185 185 00:05:57,780 --> 00:05:59,100 there off to the left. 186 186 00:05:59,100 --> 00:06:00,370 Now, in my user domain, 187 187 00:06:00,370 --> 00:06:02,230 I have an intrusion detection system 188 188 00:06:02,230 --> 00:06:03,210 that is network-based 189 189 00:06:03,210 --> 00:06:04,940 and it's hanging off that switch. 190 190 00:06:04,940 --> 00:06:07,120 Then, I have an intrusion prevention system 191 191 00:06:07,120 --> 00:06:09,140 sitting between the firewall and the router 192 192 00:06:09,140 --> 00:06:11,640 to protect myself from denial of service attacks. 193 193 00:06:11,640 --> 00:06:13,240 Then, I might have a DMZ, 194 194 00:06:13,240 --> 00:06:15,010 and I might need another IPS there 195 195 00:06:15,010 --> 00:06:16,300 that's going to be set between the switch 196 196 00:06:16,300 --> 00:06:17,890 and the firewall and that's going to protect 197 197 00:06:17,890 --> 00:06:19,970 my web servers and my email servers. 198 198 00:06:19,970 --> 00:06:22,360 In addition to all that network-based defenses, 199 199 00:06:22,360 --> 00:06:23,670 I can actually install software 200 200 00:06:23,670 --> 00:06:26,700 on PC1, PC2, and PC3 that acts 201 201 00:06:26,700 --> 00:06:29,430 as a host IDS or a host IPS. 202 202 00:06:29,430 --> 00:06:30,830 Now, all of that is going to be connected 203 203 00:06:30,830 --> 00:06:33,480 back up to the management PC up in the top, 204 204 00:06:33,480 --> 00:06:34,920 which is going to take and correlate 205 205 00:06:34,920 --> 00:06:36,470 all of these logs and alerts 206 206 00:06:36,470 --> 00:06:39,300 and that way, I can investigate them as I see them. 207 207 00:06:39,300 --> 00:06:40,420 You could see how all of this starts 208 208 00:06:40,420 --> 00:06:42,540 working together giving us layers of security 209 209 00:06:42,540 --> 00:06:44,290 and a lot more additional security.