1
00:00:00,300 --> 00:00:02,250
In this lesson, we're going to discuss

2
00:00:02,250 --> 00:00:03,930
intrusion detection systems

3
00:00:03,930 --> 00:00:05,939
and intrusion prevention systems.

4
00:00:05,939 --> 00:00:09,090
There are three types of IDS and IPS systems

5
00:00:09,090 --> 00:00:12,060
that we're going to discuss, namely network-based,

6
00:00:12,060 --> 00:00:14,130
host-based, and wireless.

7
00:00:14,130 --> 00:00:16,710
But before we talk about these three categories,

8
00:00:16,710 --> 00:00:18,000
let's take a look at the difference

9
00:00:18,000 --> 00:00:20,730
between an IDS and an IPS.

10
00:00:20,730 --> 00:00:25,020
At their core, an IDS and an IPS work very similarly.

11
00:00:25,020 --> 00:00:26,820
They're both going to be looking for bad things

12
00:00:26,820 --> 00:00:28,680
either on the network, on a host,

13
00:00:28,680 --> 00:00:31,830
or in the wireless domain depending on which type of IDS

14
00:00:31,830 --> 00:00:33,540
and IPS you're dealing with.

15
00:00:33,540 --> 00:00:35,760
But the big difference is what they do

16
00:00:35,760 --> 00:00:37,740
when they find something suspicious.

17
00:00:37,740 --> 00:00:40,680
With an IDS, it's simply going to log or alert

18
00:00:40,680 --> 00:00:43,260
that it found something suspicious or malicious.

19
00:00:43,260 --> 00:00:46,260
But if you're using an IPS, it's going to log it,

20
00:00:46,260 --> 00:00:48,180
it's going to alert on it, and it's going to take

21
00:00:48,180 --> 00:00:51,450
some kind of action, like blocking the suspicious traffic,

22
00:00:51,450 --> 00:00:53,220
preventing that application from running,

23
00:00:53,220 --> 00:00:56,100
or kicking that wireless device right off your network.

24
00:00:56,100 --> 00:00:58,860
Alright, with a basic understanding of what an IDS

25
00:00:58,860 --> 00:01:01,260
and IPS is, let's dig a little bit deeper

26
00:01:01,260 --> 00:01:02,730
into how they work.

27
00:01:02,730 --> 00:01:05,250
Let's start with Network Intrusion Detection Systems.

28
00:01:05,250 --> 00:01:08,130
Now, NIDS, or Network Intrusion Detection Systems,

29
00:01:08,130 --> 00:01:09,510
are responsible for detecting

30
00:01:09,510 --> 00:01:12,090
unauthorized network access or attacks.

31
00:01:12,090 --> 00:01:15,180
These systems are designed to verify, itemize,

32
00:01:15,180 --> 00:01:17,160
categorize, and report on a threat

33
00:01:17,160 --> 00:01:19,950
that's coming either from inside or outside of your network

34
00:01:19,950 --> 00:01:22,800
based upon the placement of your NIDS sensor.

35
00:01:22,800 --> 00:01:24,660
Now, it's important to note that these devices

36
00:01:24,660 --> 00:01:27,030
do not stop an attack, but instead,

37
00:01:27,030 --> 00:01:29,760
they're programmed to react based on certain criteria

38
00:01:29,760 --> 00:01:31,650
and send an event or alert message

39
00:01:31,650 --> 00:01:34,260
to an administrator or cybersecurity analyst.

40
00:01:34,260 --> 00:01:36,810
That person will then be responsible for preventing

41
00:01:36,810 --> 00:01:38,910
or responding to the suspected attack.

42
00:01:38,910 --> 00:01:42,060
Remember, an IDS only detects, logs,

43
00:01:42,060 --> 00:01:44,370
reports, or alerts on what it finds.

44
00:01:44,370 --> 00:01:47,610
It will not prevent the bad thing from actually happening.

45
00:01:47,610 --> 00:01:50,520
There are three types of intrusion detection systems,

46
00:01:50,520 --> 00:01:52,800
network-based, or NIDS,

47
00:01:52,800 --> 00:01:54,810
host-based, or HIDS,

48
00:01:54,810 --> 00:01:57,480
and wireless, or WIDS.

49
00:01:57,480 --> 00:01:59,130
The difference in these three systems

50
00:01:59,130 --> 00:02:01,590
is their installation placement and the type of things

51
00:02:01,590 --> 00:02:03,330
they're actually searching for.

52
00:02:03,330 --> 00:02:06,420
Network-based IDSs are usually standalone devices

53
00:02:06,420 --> 00:02:09,360
that monitor the traffic coming into or out of a network.

54
00:02:09,360 --> 00:02:12,120
Most commonly, these are configured as a network appliance

55
00:02:12,120 --> 00:02:14,790
that's installed on a spam port or mirrored port

56
00:02:14,790 --> 00:02:16,350
from your backbone switch.

57
00:02:16,350 --> 00:02:19,410
This way, it can see a copy of all the network traffic.

58
00:02:19,410 --> 00:02:22,290
Generally, you're going to see network IDSs are configured

59
00:02:22,290 --> 00:02:24,300
to look for network attacks or indications

60
00:02:24,300 --> 00:02:27,180
of an upcoming attack, something like a port scan,

61
00:02:27,180 --> 00:02:30,000
a suspicious content inside of a packet's payload,

62
00:02:30,000 --> 00:02:34,530
or traffic coming from or going to a suspicious IP or port.

63
00:02:34,530 --> 00:02:36,930
A host-based IDS, or HIDS,

64
00:02:36,930 --> 00:02:39,210
on the other hand, is going to be a piece of software

65
00:02:39,210 --> 00:02:41,370
installed on a server or endpoint.

66
00:02:41,370 --> 00:02:42,720
This is going to be configured to look

67
00:02:42,720 --> 00:02:44,850
at suspicious network traffic going to

68
00:02:44,850 --> 00:02:47,100
or from a single server or endpoint,

69
00:02:47,100 --> 00:02:48,990
namely the thing it's installed on,

70
00:02:48,990 --> 00:02:51,089
as well as any suspicious processes that are running

71
00:02:51,089 --> 00:02:53,550
or files that are being accessed.

72
00:02:53,550 --> 00:02:56,130
A wireless IDS, or WIDS,

73
00:02:56,130 --> 00:02:58,500
is going to be focused on the wireless network.

74
00:02:58,500 --> 00:03:01,200
A wireless IDS is focused on detecting attempts

75
00:03:01,200 --> 00:03:03,510
to cause a denial of service on the wireless network,

76
00:03:03,510 --> 00:03:05,550
such as flooding authentication requests,

77
00:03:05,550 --> 00:03:08,340
disassociation attacks, de-authentication attacks,

78
00:03:08,340 --> 00:03:09,960
and other things like that.

79
00:03:09,960 --> 00:03:11,790
Intrusion detection systems operate

80
00:03:11,790 --> 00:03:13,260
either using signature-based

81
00:03:13,260 --> 00:03:15,660
or anomaly-based detection algorithms.

82
00:03:15,660 --> 00:03:17,674
Signature-based IDSs analyze traffic

83
00:03:17,674 --> 00:03:19,530
based on defined signatures,

84
00:03:19,530 --> 00:03:20,899
and they can only recognize attacks

85
00:03:20,899 --> 00:03:23,520
based on the previously identified attacks that exist

86
00:03:23,520 --> 00:03:25,200
inside of its database.

87
00:03:25,200 --> 00:03:27,720
For this reason, signature-based IDSs

88
00:03:27,720 --> 00:03:29,970
require frequent updates to remain effective,

89
00:03:29,970 --> 00:03:31,860
and they are not considered effective

90
00:03:31,860 --> 00:03:33,300
against zero-day attacks

91
00:03:33,300 --> 00:03:35,430
because they've never seen those things before.

92
00:03:35,430 --> 00:03:37,020
Now, signature-based IDSs

93
00:03:37,020 --> 00:03:39,180
are further broken down into two types.

94
00:03:39,180 --> 00:03:41,820
We have pattern-matching and stateful-matching.

95
00:03:41,820 --> 00:03:44,280
Pattern-matching is going to focus on a specific pattern

96
00:03:44,280 --> 00:03:47,220
of steps that are being recognized during an attack.

97
00:03:47,220 --> 00:03:49,680
Stateful-matching is going to focus on a known baseline

98
00:03:49,680 --> 00:03:53,010
of a system and reporting any changes to that state.

99
00:03:53,010 --> 00:03:55,740
Pattern-matching is more common in network-based IDSs

100
00:03:55,740 --> 00:03:58,290
and wireless IDSs, while stateful-matching

101
00:03:58,290 --> 00:04:01,290
is more commonly used with host-based IDSs.

102
00:04:01,290 --> 00:04:04,140
Anomaly-based IDSs are going to analyze traffic

103
00:04:04,140 --> 00:04:06,330
and compare it to a normal baseline of traffic

104
00:04:06,330 --> 00:04:08,760
to determine whether there is a threat that's occurring.

105
00:04:08,760 --> 00:04:11,160
This is known as behavioral-based detection

106
00:04:11,160 --> 00:04:12,900
because it reports on anything outside

107
00:04:12,900 --> 00:04:16,410
of the normally-expected behaviors, but this can also result

108
00:04:16,410 --> 00:04:18,660
in a higher rate of false positives.

109
00:04:18,660 --> 00:04:19,800
Now, there are five types

110
00:04:19,800 --> 00:04:21,839
of anomaly-based detection systems.

111
00:04:21,839 --> 00:04:24,930
We have statistical, protocol, traffic,

112
00:04:24,930 --> 00:04:27,780
rule or heuristic, and application-based.

113
00:04:27,780 --> 00:04:30,000
Each of these types seek to identify traffic

114
00:04:30,000 --> 00:04:32,700
that appears to be outside of a normal pattern.

115
00:04:32,700 --> 00:04:34,350
For example, if the device

116
00:04:34,350 --> 00:04:36,480
is a traffic anomaly-based device,

117
00:04:36,480 --> 00:04:38,520
it's going to track the historical traffic patterns

118
00:04:38,520 --> 00:04:41,070
on that network, and it's going to report when those patterns

119
00:04:41,070 --> 00:04:43,470
are too high or too low in comparison

120
00:04:43,470 --> 00:04:45,090
to the normal baseline.

121
00:04:45,090 --> 00:04:48,510
In addition to IDSs, we also have IPSs.

122
00:04:48,510 --> 00:04:50,640
These devices not only scan the traffic to look

123
00:04:50,640 --> 00:04:53,160
for malicious activity like an IDS does,

124
00:04:53,160 --> 00:04:56,580
but they also take actions to stop that bad activity.

125
00:04:56,580 --> 00:04:58,200
When you're using an IPS though,

126
00:04:58,200 --> 00:05:00,240
you have to be careful to keep false positives

127
00:05:00,240 --> 00:05:02,610
and false negatives down to a minimum.

128
00:05:02,610 --> 00:05:05,100
Otherwise, malicious traffic may not be blocked

129
00:05:05,100 --> 00:05:08,400
when it should be, or normal activity might get blocked

130
00:05:08,400 --> 00:05:09,810
when it shouldn't be.

131
00:05:09,810 --> 00:05:12,480
For a network IPS, we want to have the device placed

132
00:05:12,480 --> 00:05:14,100
right near the border of the network,

133
00:05:14,100 --> 00:05:15,510
right behind your firewall.

134
00:05:15,510 --> 00:05:17,340
And that way, we have all the traffic funneling

135
00:05:17,340 --> 00:05:20,460
right through it so it can stop and block things as needed.

136
00:05:20,460 --> 00:05:21,810
A NIDS, on the other hand,

137
00:05:21,810 --> 00:05:23,430
should be attached through a mirrored port

138
00:05:23,430 --> 00:05:24,870
off the backbone switch.

139
00:05:24,870 --> 00:05:27,000
This way, it can analyze all the traffic

140
00:05:27,000 --> 00:05:28,440
in a passive manner.

141
00:05:28,440 --> 00:05:31,800
In some networks, both NIPS and NIDS will be used,

142
00:05:31,800 --> 00:05:34,560
and in large networks, there may be several of each device

143
00:05:34,560 --> 00:05:37,380
placed in strategic locations around your network.

144
00:05:37,380 --> 00:05:39,450
Now, host-based intrusion prevention systems

145
00:05:39,450 --> 00:05:41,400
and wireless intrusion prevention systems

146
00:05:41,400 --> 00:05:43,833
work just like the HIDS and WIDS

147
00:05:43,833 --> 00:05:45,540
that we talked about earlier.

148
00:05:45,540 --> 00:05:47,700
But the big difference is they have the ability

149
00:05:47,700 --> 00:05:49,710
of responding to that suspicious activity

150
00:05:49,710 --> 00:05:51,150
that's being detected.

151
00:05:51,150 --> 00:05:52,740
For example, let's say you're using

152
00:05:52,740 --> 00:05:54,960
a host-based intrusion prevention system.

153
00:05:54,960 --> 00:05:56,735
And now, you try to install a program

154
00:05:56,735 --> 00:05:58,620
that's going to try to change or overwrite

155
00:05:58,620 --> 00:06:00,270
a critical system file.

156
00:06:00,270 --> 00:06:02,820
That HIPS could detect that and block you

157
00:06:02,820 --> 00:06:04,470
from being able to do that.

158
00:06:04,470 --> 00:06:06,960
Similarly, if you're using a wireless IPS

159
00:06:06,960 --> 00:06:09,150
and somebody tries to send a de-authentication frame

160
00:06:09,150 --> 00:06:11,610
to clients on the network, it could detect that

161
00:06:11,610 --> 00:06:14,670
and refuse to forward those frames to the intended targets.

162
00:06:14,670 --> 00:06:17,130
And then, instead, it might take the action

163
00:06:17,130 --> 00:06:19,320
of disconnecting the person who sent them.

164
00:06:19,320 --> 00:06:22,410
Remember, with an IDS, you can only detect.

165
00:06:22,410 --> 00:06:25,293
But with an IPS, you can detect and react.