In this lesson, we're going to discuss
intrusion detection systems
and intrusion prevention systems.
There are three types of IDS and IPS systems
that we're going to discuss, namely network-based,
host-based, and wireless.
But before we talk about these three categories,
let's take a look at the difference
between an IDS and an IPS.
At their core, an IDS and an IPS work very similarly.
They're both going to be looking for bad things
either on the network, on a host,
or in the wireless domain depending on which type of IDS
and IPS you're dealing with.
But the big difference is what they do
when they find something suspicious.
With an IDS, it's simply going to log or alert
that it found something suspicious or malicious.
But if you're using an IPS, it's going to log it,
it's going to alert on it, and it's going to take
some kind of action, like blocking the suspicious traffic,
preventing that application from running,
or kicking that wireless device right off your network.
Alright, with a basic understanding of what an IDS
and IPS is, let's dig a little bit deeper
into how they work.
Let's start with Network Intrusion Detection Systems.
Now, NIDS, or Network Intrusion Detection Systems,
are responsible for detecting
unauthorized network access or attacks.
These systems are designed to verify, itemize,
categorize, and report on a threat
that's coming either from inside or outside of your network
based upon the placement of your NIDS sensor.
Now, it's important to note that these devices
do not stop an attack, but instead,
they're programmed to react based on certain criteria
and send an event or alert message
to an administrator or cybersecurity analyst.
That person will then be responsible for preventing
or responding to the suspected attack.
Remember, an IDS only detects, logs,
reports, or alerts on what it finds.
It will not prevent the bad thing from actually happening.
There are three types of intrusion detection systems,
network-based, or NIDS,
host-based, or HIDS,
and wireless, or WIDS.
The difference in these three systems
is their installation placement and the type of things
they're actually searching for.
Network-based IDSs are usually standalone devices
that monitor the traffic coming into or out of a network.
Most commonly, these are configured as a network appliance
that's installed on a spam port or mirrored port
from your backbone switch.
This way, it can see a copy of all the network traffic.
Generally, you're going to see network IDSs are configured
to look for network attacks or indications
of an upcoming attack, something like a port scan,
a suspicious content inside of a packet's payload,
or traffic coming from or going to a suspicious IP or port.
A host-based IDS, or HIDS,
on the other hand, is going to be a piece of software
installed on a server or endpoint.
This is going to be configured to look
at suspicious network traffic going to
or from a single server or endpoint,
namely the thing it's installed on,
as well as any suspicious processes that are running
or files that are being accessed.
A wireless IDS, or WIDS,
is going to be focused on the wireless network.
A wireless IDS is focused on detecting attempts
to cause a denial of service on the wireless network,
such as flooding authentication requests,
disassociation attacks, de-authentication attacks,
and other things like that.
Intrusion detection systems operate
either using signature-based
or anomaly-based detection algorithms.
Signature-based IDSs analyze traffic
based on defined signatures,
and they can only recognize attacks
based on the previously identified attacks that exist
inside of its database.
For this reason, signature-based IDSs
require frequent updates to remain effective,
and they are not considered effective
against zero-day attacks
because they've never seen those things before.
Now, signature-based IDSs
are further broken down into two types.
We have pattern-matching and stateful-matching.
Pattern-matching is going to focus on a specific pattern
of steps that are being recognized during an attack.
Stateful-matching is going to focus on a known baseline
of a system and reporting any changes to that state.
Pattern-matching is more common in network-based IDSs
and wireless IDSs, while stateful-matching
is more commonly used with host-based IDSs.
Anomaly-based IDSs are going to analyze traffic
and compare it to a normal baseline of traffic
to determine whether there is a threat that's occurring.
This is known as behavioral-based detection
because it reports on anything outside
of the normally-expected behaviors, but this can also result
in a higher rate of false positives.
Now, there are five types
of anomaly-based detection systems.
We have statistical, protocol, traffic,
rule or heuristic, and application-based.
Each of these types seek to identify traffic
that appears to be outside of a normal pattern.
For example, if the device
is a traffic anomaly-based device,
it's going to track the historical traffic patterns
on that network, and it's going to report when those patterns
are too high or too low in comparison
to the normal baseline.
In addition to IDSs, we also have IPSs.
These devices not only scan the traffic to look
for malicious activity like an IDS does,
but they also take actions to stop that bad activity.
When you're using an IPS though,
you have to be careful to keep false positives
and false negatives down to a minimum.
Otherwise, malicious traffic may not be blocked
when it should be, or normal activity might get blocked
when it shouldn't be.
For a network IPS, we want to have the device placed
right near the border of the network,
right behind your firewall.
And that way, we have all the traffic funneling
right through it so it can stop and block things as needed.
A NIDS, on the other hand,
should be attached through a mirrored port
off the backbone switch.
This way, it can analyze all the traffic
in a passive manner.
In some networks, both NIPS and NIDS will be used,
and in large networks, there may be several of each device
placed in strategic locations around your network.
Now, host-based intrusion prevention systems
and wireless intrusion prevention systems
work just like the HIDS and WIDS
that we talked about earlier.
But the big difference is they have the ability
of responding to that suspicious activity
that's being detected.
For example, let's say you're using
a host-based intrusion prevention system.
And now, you try to install a program
that's going to try to change or overwrite
a critical system file.
That HIPS could detect that and block you
from being able to do that.
Similarly, if you're using a wireless IPS
and somebody tries to send a de-authentication frame
to clients on the network, it could detect that
and refuse to forward those frames to the intended targets.
And then, instead, it might take the action
of disconnecting the person who sent them.
Remember, with an IDS, you can only detect.
But with an IPS, you can detect and react.