Intrusion Detection and Prevention Systems (IDS/IPS)

Intrusion Detection and Prevention Systems (IDS/IPS) are crucial for monitoring and analyzing network traffic to detect and mitigate potential security threats. They are essential tools in network security management.

IDS vs. IPS

• Intrusion Detection System (IDS):

  • Function: Detects and alerts on potentially malicious traffic but does not take action to block it.

  • Action: Logs and sends alerts when suspicious activity is detected.

  • Type: Can be either network-based (NIDS) or host-based (HIDS).

• Intrusion Prevention System (IPS):

  • Function: Monitors and actively blocks or drops malicious traffic based on detected threats.

  • Action: Adjusts firewall rules to prevent or block malicious activities.

  • Type: Can also be network-based (NIPS) or host-based (HIPS).

Network-Based IDS/IPS (NIDS/NIPS)

• Deployment: Installed on a network segment to monitor all traffic within that segment.

• Traffic Monitoring:

  • Port Mirroring: Utilizes port mirroring functionality on enterprise switches to view all traffic.

  • Promiscuous Mode: The network interface in promiscuous mode captures all packets for analysis.

• Placement:

  • NIDS: Passive monitoring, does not alter traffic flow.

  • NIPS: Active monitoring, placed in-line with traffic to take immediate action.

Host-Based IDS/IPS (HIDS/HIPS)

• Deployment: Installed on individual hosts to monitor traffic to and from that specific host.

• Additional Monitoring: May include monitoring system files for unauthorized changes.

Signature-Based Detection

• Function: Detects known threats using predefined signatures, similar to antivirus software.

• Custom Rules: Allows for creation of rules to detect suspicious traffic not covered by existing signatures.

• Limitations: May not detect new or highly targeted attacks without specific signatures.

Alerting and Response

• Detection Actions:

  • Logging: Records details of detected threats.

  • Alerting: Sends notifications to security teams, which may include detailed information and references.

  • Severity-Based Responses: Alerts can trigger various response levels, from routine follow-ups to immediate action.

Summary

IDS/IPS systems are essential for detecting and preventing malicious network activities. IDS focuses on detection and alerting, while IPS actively blocks threats. Proper deployment, including the use of port mirroring and promiscuous mode, ensures comprehensive network monitoring. Regular updates to signatures and custom rules enhance the system's effectiveness in identifying and mitigating threats. 🛡️📈