CCNA Security: Intrusion Prevention

Implementing Intrusion Prevention

• Chapter 5 focuses on intrusion prevention implementation, as part of the CCNA Security v2.0 curriculum.

IPS Technologies

• Section 5.1 explores IPS technologies and explains zero-day attacks.
• Monitoring, detecting, and stopping attacks are key elements in IPS.
• Aims to describe the advantages and disadvantages of both Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS).

IDS and IPS Characteristics

• Zero-day attacks exploit vulnerabilities that are unknown to the software vendor.
• IDS operates passively, requiring traffic mirroring.
• Mirrored network traffic will not pass through the IDS.
• IPS operates in inline mode and monitors traffic at Layers 3 and 4.
• IPS stops single-packet attacks and immediately responds, preventing malicious traffic from passing.
• IPS inspects traffic content at the application layer and blocks it.
• There are a few similarities between IDS and IPS which include deployment as sensors, use signatures to detect patterns of misuse, and detect atomic or composite patterns in traffic.

Advantages and Disadvantages of IDS and IPS

• IDS advantages include no network impact and continued operation even with sensor failure or overload.
• IDS disadvantages include the inability to stop the triggering event.
• IPS advantages includes abilities to stop trigger packets
• IPS disadvantages include potential network traffic disruption from sensor issues, network impact from overloading, and some impact on overall network performance.

Network-Based IPS Implementations

• Host-Based IPS provides protection specific to a host operating system.
• Host-Based IPS offers OS and application level protection, securing the host after message decryption.
• Host-Based IPS is usually dependent on the operating system and needs to be installed on all hosts.
• Network-Based IPS is cost-effective and OS independent.
• Network-Based IPS cannot examine encrypted traffic and must stop malicious traffic before it reaches a host.

IPS Solutions

• Cisco offers modular and appliance-based IPS solutions.
• These include Cisco IPS AIM, Network Module Enhanced (IPS NME), ASA AIP-SSM, IPS 4300 Series Sensors, and Catalyst 6500 Series IDSM-2.
• IPS sensor selection and deployment considers factors like network traffic volume, network topology, security budget, and available security staff.

Promiscuous Mode

• "Promiscuous Mode" uses the switch SPAN port to sends copies of traffic for analysis.
• The IDS then analyses a duplicate of all traffic, rather than the actual traffic.

Inline Mode

• Inline Mode is where the IPS Sensor sits to analyze all traffic

Modes of Deployment

• The common method of deployment includes "Promiscuous Mode" for IDS.
• The common method of deployment includes "Inline Mode" for IPS.

Cisco Switched Port Analyzer

• Port mirroring can be used to sniff traffic on both Hubs and Switches
• Cisco SPAN is used to monitor network traffic
• The monitor session command associates a source port and destination port with a SPAN session.
• Show monitor command is used to verify the SPAN session.

IPS Signatures

• Section 5.2 focuses on IPS signatures, their characteristics, alarms, management, monitoring, and global correlation of Cisco IPS devices.
• IPS signatures consist of a set of rules used to detect intrusion activity.
• Signatures have three attributes which include a type, a trigger (alarm), and an action
• Signatures are categorized as either atomic or composite.
• Atomic signatures consist of a single packet, activity, or event for detection.
• Composite signatures identify a sequence of operations across multiple hosts over time.
• The latest should be uploaded to an IPS as threats evolve.
• Signature Alarm has both advantages and disadvantages.
• IPS signatures actions include the generation of an alert, logging of activity, preventing activities

Signature Alarms

• Pattern-based detection is easy to configure and has fewer false positives with good signature design.
• Anomaly-based detection is simple and reliable with customized policies.
• Policy-based detection is readily configured and detects unknown attacks.
• Honey pot-based detection enables window to view attacks, confuse attackers, slow down and avert attacks

Pattern-Based Detection example

• Atomic signature looks for no state to examine pattern to determine an appropriate action.
• An atomic signature example will detect a ARP request that has a source ethernet address of FF:FF:FF:FF:FF:FF:FF.
• Composite signature has to examine what state has to be appied, or even multiple states.
• An example composite signature is searching for a "confidential" string in a TCP session

Anomaly-Based Detection example

• Atomic signatures have no state required to identify activity that deviates from the configured profile.
• The composite signature looks at what state is required to identify if the profile deviates from its initial configuration

Policy Detection Example

Policy will identify what type of packets are detected, and compare them against the profile.

Alarm Triggering Mechanism

• False positives: Normal traffic triggers an alarm, requiring tuning of the alarm.
• False negatives: An attack occurs, but no alarm is generated, requiring alarm tuning.
• True positives: An attack occurs which triggers an alarm, representing an ideal setting.
• True negatives: Normal traffic with no alarm generated, also representing an ideal setting.

Secure Device Event Exchange

• Secure Device Event Exchange is used for network managmen and to monitor alarms over Syslog