>> Moving right along to intrusion
>> detection and prevention.
>> With intrusion detection and
prevention systems on our network,
we want to specify the difference.
An IDS, intrusion detection system,
is going to be a passive device
that's going to be a device that monitors the network,
and if malicious activity is detected,
it can alert administrator or log an entry,
but it does not terminate the attack.
The intrusion prevention system is actually
an active device that can terminate the attack.
It might send a TCP reset to terminate the connection.
It could reconfigure a firewall,
but ultimately, the IPS is active.
Quite honestly, today you're going to have
both combined in a single system.
You'll have detection and prevention,
but on the exam when they separate the two out,
we've got to honor that.
If they say IDS,
purely detection, IPS is going to be more active.
There are different types of
>> intrusion detection systems.
>> We have HIDS and we have NIDS.
A HIDS is a host-based system.
It's basically a software that you
install on a particular system,
and its job is to monitor activities
>> just on that system.
>> If I want to find out who's modifying
the registry or if I want to find out
how much network traffic is coming to
this particular NIC or if there's any local access,
that's going to be fine with the HIDS.
That's what a HIDS is designed to inspect.
If I want to monitor the areas of the network,
I'm going to need a NIDS,
a network intrusion detection system.
NIDS is a glorified sniffer.
We said a sniffer is a device that has
a network card in promiscuous mode,
so it captures all traffic regardless of destination.
Well, when you add a sniffer to an analysis engine,
now you have an IDS.
Now you have an intrusion detection system.
We still have to have that network card
in promiscuous mode,
but if we're plugging into a switch,
don't forget the idea of port span,
so that way we can monitor switch-based traffic.
Those same things we learned about sniffers are
going to apply to network IDS.
Looking at the different components,
we're going to have a network sensor.
The sensor is where data is collected.
You're going to have an analysis engine that
evaluates whether or not the traffic
>> is malicious or not.
>> A lot of times,
that analysis engine is going to look for
either signatures or behaviors to
determine if the traffic is malicious.
We have pattern matching systems.
These are your signature-based systems.
They're looking for known patterns.
After an attack is determined,
then the signature files are updated,
and they have the specifics of the attack.
As long as the attack matches
those specifics that are stored in signatures,
then the IDS is going to be able to
detect the attack and create an alert.
The problem with that is
sometimes there are attacks that have
not had signatured files created for them yet.
Sometimes when an attack first comes out,
it might take a couple of weeks
for these signatures to be published.
We refer to those as zero-day attacks,
attacks in which there are no signatures.
Of course, a pattern matching
system that's just looking for
patterns won't be able to detect those zero days.
An alternative to that is profile matching systems.
These are sometimes referred
to as behavior-based systems.
Ultimately, it'll take a snapshot
or a baseline of your network,
and then the profile matching
>> system identifies anything
>> beyond that baseline within
a certain threshold as being an attack.
The problem with that is there's a lot of activity that
varies on a network on any given day or time,
so you can have unusual activity that isn't malicious.
With your profile matching systems,
you often have what we refer to as false positives.
A positive is when an IDS
indicates that there's an attack.
I always think it's the IDS saying,
"I'm positive there's an attack."
A false positive means the IDS alerts you that there
is an attack going on but when there really isn't.
That's always concerning as a false negative.
With the false negative,
the IDS does not sound the alert,
but an attack is happening.
We don't really want either of those.
When we talk about false positives and false negatives,
the way we re-evaluate these analysis engines for
their accuracy because the two are inversely related.
If I don't want any false positives,
I'm likely to increase my false negatives.
If I don't want any false negatives,
I'm going to increase my false positives.
At some point in time, those two are going to match.
We talked about that a little bit with biometrics.
With biometrics, it's called the crossover error rate.
It's the same concept for intrusion detection systems,
and that's a measure of the system's accuracy.
Other devices we might want on
>> our network are honeypots.
>> Honeypots are distractions. For instance,
I usually put a honeypot in my DMZ,
and it's a system that looks vulnerable.
It needs to look appealing to an attacker.
The idea is that if an attacker is
in my DMZ looking around for trouble,
I'm going to serve up this desirable
>> vulnerable systems.
>> That way, they can attack the system
and keep them away from my real resources.
Also, honeypots software has
some detective tools that track
the activities of the attacker so I can
go back and review those logs and get some idea
about the type of attack
and the type of tools that were used.
What we want to be careful about is that we
operate the honeypots in an ethical fashion.
We want that honeypot to be enticing,
but we don't want it to trick someone into launching
an attack or compromising a system.
I don't want to say, "Hey,
click here for free music," and try
to prosecute somebody because they've clicked.
There is a fine line between enticement and entrapment.
A few other really important systems are
security information and event managers
, or SIEMs systems.
These provide us aggregation
across a wide variety of devices.
I've got lots of servers, firewalls, honeypots,
and intrusion detection systems in my network,
and I can go to each one and review the logs.
That doesn't really give me the big picture.
With our SIEMs systems,
we can aggregate the logs and
other information from all these different devices,
put them all together on a single system,
the SIEM, and use the tools.
For instance, there are tools
that help me correlate events
and help me with trending and forecasting analysis,
aggregation, and correlation.
Those are SIEMs systems.
If you've ever heard of Splunk or used Splunk,
that's a good example of a SIEM system.
I also want to mention
>> unified threat management systems.
>> These do not have a specific set of requirements.
This is just a generic term for
all these accompanying systems.
I might have a single device that gives me a firewall,
anti-malware, my router,
and you can see all these different services.
It doesn't have to provide any
>> specific set of services,
>> but it's one of those multipurpose devices.
Then we think about network load balancing,
and you can have hardware or software load balancers.
The whole purpose of load balancing is to ensure
that the work is distributed across nodes.
A lot of time, we have this implemented in a cluster,
or you might have five nodes in a cluster,
and we want to make sure that
each device handles their fair share of the work,
so load balancing does that.
Comparable to that, we have traffic shapers.
Traffic shapers often look for
specifics about a packet that would help with
prioritization and specifically for
things like labels that would indicate void traffic.
Void traffic gets a higher priority
because of these needs.
Those two are more about
increasing efficiency and distribution.