-: Intrusion detection and intrusion protection systems. 2 2
Now, in this lesson, we're going to talk 3 3
about IDSs and IPSs. 4 4
We've mentioned them briefly before 5 5
but now, we're going to dig into them. 6 6
Now, when we talk about IDS or intrusion detection system, 7 7
or IPS, an intrusion prevention system, 8 8
these can recognize network attacks. 9 9
And in the case of intrusion prevention system, 10 10
they can actually respond appropriately. 11 11
It's going to analyze all the incoming data 12 12
for any attacks it knows about using 13 13
different detection mechanisms 14 14
like a signature or behavioral-based model. 15 15
And we'll talk about more of those 16 16
as we go through this video, too. 17 17
Now, one of the most common ones is known as Snort. 18 18
S-N-O-R-T, which you can see here on the screen. 19 19
Snort is a software-based intrusion detection 20 20
and intrusion prevention system. 21 21
It is open source and it is widely used in the industry. 22 22
Now, when you're dealing 23 23
with intrusion detection system, 24 24
this is considered a passive device. 25 25
It's going to operate in parallel to your network, 26 26
and you can see it here in the diagram 27 27
hanging off just below the switch in this diagram. 28 28
Now, it's going to monitor all the traffic 29 29
going across the network and it's going to log in. 30 30
And it's going to alert any time it sees something 31 31
that it thinks is bad. 32 32
So, if it thinks it sees something bad, 33 33
like there might be an attack going on, 34 34
it might see something like a port scan 35 35
or denial of service attack, 36 36
or anything else that matches 37 37
its database to signatures, 38 38
then, it's going to alert the system administrator. 39 39
But because it's a detection system, 40 40
it's not going to respond. 41 41
All it's going to do is log in. 42 42
It might capture some packet data on it, 43 43
if you configured it to do that 44 44
and then, it's going to send the alert 45 45
to the administrator who's going to go ahead 46 46
and investigate it further. 47 47
Now, on the other hand, if you have it configured 48 48
as an intrusion prevention system, 49 49
this is considered an active device. 50 50
And so, it has to operate in-line. 51 51
Notice how it's now placed here 52 52
between the firewall and the switch, 53 53
so all the traffic from the attacker 54 54
and from the Internet 55 55
has to go through this device as it goes 56 56
through the router and the firewall into your network. 57 57
This way, by using this intrusion prevention system, 58 58
it can actually have all the data going through it 59 59
and it can stop and block any data 60 60
that it thinks is bad. 61 61
Now, again, this is going to be based off 62 62
of the signatures you have programmed. 63 63
It's going to monitor all the traffic, 64 64
send all the alerts, do all the logging, 65 65
do the packet capture, 66 66
all of the stuff like an IDS would. 67 67
But because it's a prevention system, 68 68
it can also drop or block offending traffic. 69 69
Therefore, it can actually stop an attack in progress. 70 70
Now, if you're worried about a denial of service attack, 71 71
an IPS is one of the best ways 72 72
to prevent this from happening. 73 73
Now, why would we use an IDS versus an IPS? 74 74
Cause it sounds like an IPS is awesome. 75 75
Well, one of the problems is that IPSs 76 76
and IDSs are not always tuned properly. 77 77
And so, if you have a false positive, 78 78
you can actually drop legitimate traffic 79 79
if you're using an IPS. 80 80
So, that's one of the reasons 81 81
why a lot of organizations operate 82 82
these detection systems in detection mode 83 83
and not prevention mode. 84 84
Speaking of detection, how can we detect different things? 85 85
Well, there are really three main methods. 86 86
We have signature-based detection, 87 87
policy-based detection, and anomaly-based detection. 88 88
When you're dealing with signature-based detection, 89 89
this is where a signature contains 90 90
a string of bytes that acts as a unique 91 91
fingerprint or some sort of a pattern 92 92
that's going to be triggering that detection. 93 93
Think of it like a signature 94 94
from malware or your hand signature. 95 95
I can look at it and say, 96 96
"Ah, I know this is John Smith's signature, 97 97
I've seen it before." 98 98
That's essentially what we're doing here 99 99
with the data flowing through the network. 100 100
Now, these signatures have to be created by yourself 101 101
or you can download them from a central repository. 102 102
Now, if you find a signature that matches something 103 103
that isn't threatening, but you have your device 104 104
in prevention mode, guess what? 105 105
That's going to cause issues for you 106 106
because it's going to block it. 107 107
And this again is why people tend 108 108
to lean towards an IDS instead of an IPS. 109 109
Next, we have policy-based detection. 110 110
And this is going to rely on a specific 111 111
declaration of a security policy. 112 112
You may say something like, 113 113
"No Telnet allowed." 114 114
and if we see anybody trying to talk on Port 23, 115 115
we know that's a policy issue 116 116
and we're going to flag it in the logs 117 117
and we're going to alert on it. 118 118
That's the idea of policy-based detection. 119 119
Now, the third one we have is an anomaly-based detection. 120 120
And this is either going to be done 121 121
through a statistical or non-statistical anomaly. 122 122
Now, if it's using a statistical anomaly, 123 123
it's going to watch for traffic patterns 124 124
and build a baseline up and then anytime it sees 125 125
something that thinks is outside the normal, 126 126
it's going to flag it. 127 127
Again, if you're using an IPS, 128 128
this can be very, very dangerous. 129 129
Because something that is completely normal 130 130
and routine that's just a little bit outside 131 131
the normal baseline could be flagged 132 132
and cause issues for your end users. 133 133
Now, when you use a non-statistical anomaly, 134 134
this is based on a pattern or baseline 135 135
that the administrator is going to define. 136 136
So, I might go in and configure and say, 137 137
"Hey, anytime I see more than some amount of downloads, 138 138
it's over a gigabyte per user per day, 139 139
I want you to flag that 140 140
because that might be something that's not right." 141 141
These are the kind of things 142 142
that we're going to set by the administrator 143 143
and they would then be a non-statistical anomaly. 144 144
In addition to having an intrusion detection system 145 145
and intrusion prevention system, 146 146
we could also have either host-based 147 147
or network-based IDSs and IPSs. 148 148
And this is another way we distinguish these systems. 149 149
When we're dealing with the network-based one, 150 150
we're talking about a network device 151 151
that's going to protect the entire network. 152 152
The diagrams I showed you earlier 153 153
were example of a network-based IDS and IPS, 154 154
were either hung off the switch 155 155
or it was between the switch and the firewall. 156 156
Now, if I wanted to have it as a software 157 157
installed on the host 158 158
like your Windows or your Mac machine, 159 159
this would be a piece of software 160 160
we install and it can serve 161 161
as an IDS or an IPS, as well. 162 162
Those are considered host-based 163 163
because it's sitting on a host or a server. 164 164
This would be your clients, 165 165
your servers, your phones, your tablets. 166 166
Now, these network and host-based systems 167 167
can be used together to give you even more protection. 168 168
For example, you might have a network 169 169
intrusion prevention system that's going to be used 170 170
in-line to protect you 171 171
from a denial of service attack. 172 172
But then, you might also have a host-based 173 173
intrusion prevention system on your Windows server 174 174
that can prevent people from installing 175 175
and running software that you don't authorize. 176 176
This is going to help protect you 177 177
from malware attacks and other things like that. 178 178
Now, what is all these look like 179 179
when you put it together? 180 180
Well, it looks kind of like this. 181 181
Notice here, I have two switches 182 182
hanging off that router. 183 183
I have my administrative and my management network. 184 184
And I also have my users who are sitting 185 185
there off to the left. 186 186
Now, in my user domain, 187 187
I have an intrusion detection system 188 188
that is network-based 189 189
and it's hanging off that switch. 190 190
Then, I have an intrusion prevention system 191 191
sitting between the firewall and the router 192 192
to protect myself from denial of service attacks. 193 193
Then, I might have a DMZ, 194 194
and I might need another IPS there 195 195
that's going to be set between the switch 196 196
and the firewall and that's going to protect 197 197
my web servers and my email servers. 198 198
In addition to all that network-based defenses, 199 199
I can actually install software 200 200
on PC1, PC2, and PC3 that acts 201 201
as a host IDS or a host IPS. 202 202
Now, all of that is going to be connected 203 203
back up to the management PC up in the top, 204 204
which is going to take and correlate 205 205
all of these logs and alerts 206 206
and that way, I can investigate them as I see them. 207 207
You could see how all of this starts 208 208
working together giving us layers of security 209 209
and a lot more additional security.