Now, in this lesson,
we're going to talk about IDSs and IPSs.
Now, when we talk about an IDS
or an intrusion detection system,
or an IPS, an intrusion prevention system,
these can recognize network attacks.
And in the case of an intrusion prevention system,
they can actually respond appropriately.
It's going to analyze all the incoming data
for any attacks it knows about
using different detection mechanisms,
like a signature or behavioral-based model.
And we'll talk about more of those
as we go through this video too.
Now, one of the most common ones is known as Snort,
S-N-O-R-T, which you can see here on the screen.
Snort is a software-based intrusion detection
and intrusion prevention system.
It is open sourced and it is widely used in the industry.
Now, when you're dealing with an intrusion detection system,
this is considered a passive device.
It's going to operate in parallel to your network.
And you can see it here in the diagram
hanging off just below the switch in this diagram.
Now, it's going to monitor all the traffic
going across the network and it's going to log it.
And it's going to alert anytime it sees something
that it thinks is bad.
So, if it thinks it sees something bad,
like there might be an attack going on,
it might see something like a port scan
or denial of service attack
or anything else that matches its database of signatures,
then it's going to alert the system administrator.
But because it's a detection system,
it's not going to respond.
All it's going to do is log it.
It might capture some packet data on it
if you've configured it to do that,
and then it's going to send the alert to the administrator
who's going to go ahead and investigate it further.
Now, on the other hand, if you have it configured
as an intrusion prevention system,
this is considered an active device,
and so it has to operate in-line.
Notice how it's now placed here between the firewall
and the switch, so all the traffic from the attacker
and from the internet has to go through this device
as it goes through the router and the firewall
into your network.
This way, by using this intrusion prevention system,
it can actually have all the data going through it,
and it can stop and block any data that it thinks is bad.
Now, again, this is going to be based off the signatures
you have programmed.
It's going to monitor all the traffic, send all the alerts,
do all the logging, do the packet capture,
all the stuff like an IDS would.
But because it's a prevention system,
it can also drop or block offending traffic.
Therefore, it can actually stop an attack in progress.
Now, if you're worried about a denial of service attack,
an IPS is one of the best ways
to prevent this from happening.
Now, why will we use an IDS versus an IPS
because it sounds like an IPS is awesome?
Well, one of the problems
is IPSs and IDSs are not always tuned properly,
and so if you have a false positive,
you can actually drop legitimate traffic
if you're using an IPS.
So that's one of the reasons why a lot of organizations
operate these detection systems in detection mode
and not prevention mode.
Speaking of detection, how can we detect different things?
Well, there are really three main methods.
We have signature-based detection,
policy-based detection,
and anomaly-based detection.
When you're dealing signature-based detection,
this is where a signature contains a string of bytes
that acts as a unique fingerprint or some sort of pattern
that's going to be triggering that detection.
Think of it like a signature for malware
or your hand signature.
I can look at it and say,
"Ah, I know this is John Smith's signature.
I've seen it before."
That's essentially what we're doing here
with the data flowing through the network.
Now, these signatures have to be created by yourself,
or you can download them from a central repository.
Now, if you find a signature that matches something
that isn't threatening, but you have your device
in prevention mode, guess what?
That's going to cause issues for you
because it's going to block it.
And this again is why people tend
to lean towards an IDS instead of an IPS.
Next, we have policy-based detection,
and this is going to rely on a specific declaration
of a security policy.
You may say something like, "No telnet allowed."
And if we see anybody trying to talk on port 23,
we know that's a policy issue
and we're going to flag it in the logs
and we're going to alert on it.
That's the idea of a policy-based detection.
Now, the third one we have is an anomaly-based detection,
and this is either going to be done through a statistical
or non-statistical anomaly.
Now, if it's using a statistical anomaly,
it's going to watch for traffic patterns
and build a baseline up,
and then anytime it sees something it thinks
is outside the normal, it's going to flag it.
Again, if you're using an IPS,
this can be very, very dangerous
because something that is completely normal in routine
that's just a little bit outside the normal baseline
could be flagged and cause issues for your end users.
Now, when you use a non-statistical anomaly,
this is based on a pattern or baseline
that the administrator is going to define.
So I might go in and configure and say,
"Hey, anytime I see more than some amount of downloads,
it's over a gigabyte per user per day,
I want you to flag that because that might be something
that's not right."
These are the kind of things that we're going to set
by the administrator,
and they would then be a non-statistical anomaly.
In addition to having an intrusion detection system,
an intrusion prevention system,
we could also have either host-based
or network-based, IDSs and IPSs.
And this is another way we distinguish these systems.
When we deal with a network-based one,
we're talking about a network device
that's going to protect the entire network.
The diagrams I showed you earlier
were an example of a network-based IDS and IPS
were either hung off the switch
or was between the switch and the firewall.
Now, if I wanted to have this as software installed
on a host like your Windows or your Mac machine,
this would be a piece of software we install
and it can serve as an IDS or an IPS as well.
Those are considered host-based
because it's sitting on a host or a server.
This would be your clients, your servers,
your phones, your tablets.
Now, these network and host-based systems
can be used together to give you even more protection.
For example, you might have
a network intrusion prevention system
that's going to be used in-line to protect you
from a denial of service attack.
But then you might also have
a host-based intrusion prevention system
on your Windows server that can prevent people
from installing and running software
that you don't authorize.
This is going to help protect you from malware attacks
and other things like that.
Now, what does all this look like when you put it together?
Well, it looks kind of like this.
Notice here I have two switches hanging off that router.
I have my administrative and my management network.
And I also have my users
who are sitting there off to the left.
Now in my user domain, I have an intrusion detection system
that is network based and it's hanging off that switch.
Then I have an intrusion prevention system
sitting between the firewall and the router
to protect myself from denial of service attacks.
Then I might have a screen subnet
and I might need another IPS there
that's going to be set between the switch and the firewall,
and that's going to protect my web servers
and my email servers.
In addition to all that network-based defenses,
I can actually install software on PC1, PC2, and PC3
that acts as a host IDS or a host IPS.
Now, all of that is going to be connected
back up to the management PC, up in the top,
which is going to take and correlate
all of these logs and alerts,
and that way I can investigate them as I see them.
You can see how all of this starts working together
to give us layers of security
and a lot more additional security.