CCNA Security v2.0: Intrusion Prevention

- Implementing Intrusion Prevention is covered in Chapter 5 of CCNA Security v2.0
- Dr. Nadhir Ben Halima is the author

### IPS Technologies
- This section explains zero-day attacks
- It covers how to monitor, detect, and stop attacks
- It also describes the advantages and disadvantages of IDS and IPS

### IDS and IPS Characteristics
- A zero-day attack is an attack that exploits a previously unknown vulnerability
- The monitor traffic passively and require mirroring to reach it 
- Network traffic does not pass through IDS unless mirrored
- IPS is implemented in an inline mode
- IPS monitors Layer 3 and Layer 4 traffic
- IPS stops single packet attacks from reaching target
- IPS responds immediately and will not allow malicious traffic to pass
- IPS inspects malicious traffic content at the application layer and blocks it
- Both IDS and IPS are deployed as sensors
- Both IDS and IPS use signatures to detect patterns of misuse in network traffic
- Both can detect atomic patterns, ie single-packed, or composite patterns, ie multi-packet

### IDS vs IPS - Advantages and Disadvantages
- IDS: No impact on network, no impact given sensor failure/overload. Disadvantage = response action cannot stop trigger
- IPS: Stops trigger packets. Disadvantage = sensor issues/overloading affects network traffic, some impact on network

### Network-Based IPS Implementations
- Host-Based IPS Advantages: Provides protection specific to a host operating system along with the operating system and application level protection, and protects the host after the message is decrypted
- Host-Based IPS Disadvantages: Operating system dependent, and must be installed on all hosts
- Network-Based IPS Advantages: Cost effective and the OS is independent
- Network-Based IPS Disadvantages: Cannot examine encrypted traffic and must stop malicious traffic prior to arriving at the host

### Cisco IPS Solutions
- Cisco offers Modular and Appliance-Based IPS Solutions
- Cisco IPS AIM and Network Module Enhanced (IPS NME)
- Cisco ASA AIP-SSM
- Cisco IPS 4300 Series Sensors
- Cisco Catalyst 6500 Series IDSM-2

### Choosing/Deploying an IPS Sensor
- Factors include amount of network traffic, network topology, the security budget and security staff available to manage IPS

### IPS Advantages and Disadvantages
- Network IPS Advantages: cost-effective, not visible on the network, OS independent and can see lower level network events
- Network IPS Disadvantages: Cannot determine if the attack was successful, nor can they examine encrypted traffic

### Modes of Deployment
- Promiscuous Mode and Inline Mode exist
- Promiscuous mode is associated with IDS
- Inline mode is associated with IPS

### SPAN 
- Cisco Switched Port Analyzer sends copies of the traffic

### Cisco SPAN usage
-  Associate a source port and a destination port with a SPAN session
- To Verify the SPAN session use the Show monitor command

### IPS Signatures
- IPS Signatures: Understand IPS signature characteristics, explain IPS signature alarms, manage and monitor IPS, and understand the global correlation of Cisco IPS devices

### IPS Signature Characteristics
- A signature is a set of rules that an IDS and an IPS use to detect typical intrusion activity
- Signatures have three distinct attributes: type, trigger (alarm), action

### Signature Type details
- Atomic signature: this simplest type includes a single packet, activity, or event that is examined to determine if it matches a configured signature
- Composite signature: identifies a sequence of operations distributed across multiple hosts over an arbitrary period of time

### Signature File details
- As new threats are identified, signatures need to be created and uploaded to an IPS
- A signature file contains a package of network signatures

### IPS Signature Alarms
- Categories include Pattern-based, Anomaly-based, Policy-based and Honey pot-based Detection,

### Signature Alarm types
- Pattern-based Detection, is easy easy to configure due to fewer false positives and a superior signatures design
- Anomaly-based Detection is reliable because of customized policies
- Policy-based Detection is easy to configure and can detect unknown attacks
- Honey pot-based Detection allows you to view attacks, distract and confuse attackers, slow down and avert attacks, and collect information about attack

### Signature Alarms - Disadvantages
- Pattern-based Detection: Cannot detect unknown signatures must be created, updated, and tuned and initially include a lot of false positives
- Anomaly-based Detection: Produces generic output and the policy must be created
- Policy-based Detection: Difficult to profile typical activity in large networks and the traffic profile must be constant
- Honey pot-based Detection: Requires a dedicated honey pot server (hot pot) that must not be trusted

### Signature Type Example
- Atomic Signature: No state required to examine pattern to determine if signature action applied given Pattern-based Detection
- Composite Signature: With Pattern-based Detection, must contain state or examine multiple items to determine if signature action should be applied.

### Atomic Signature Action
- An example is when detecting an Address Resolution Protocol (ARP) request that has a source Ethernet address of FF:FF:FF:FF:FF:FF.

### Composite Signature Action
- An example is when searching for the string "confidential" across multiple packets in a TCP session.

### Composite Signature example with Anomaly-based Detection
-  State required to identify activity that deviates from normal profile
- An example is verifying protocol compliance for HTTP traffic.

### Action Trigger types
- Normal user traffic: Indicates a false positive whereby an alarm is generated when there is no actual threat necessitating a tune alarm
- Attack traffic: Indicates a true positive where there is alarm generated in order to reach ideal settings
- Attack traffic: Indicates a false negative whereby  No alarm generated when there is one necessitating a tune alarm
- Normal user traffic: Indicates a true negative (an ideal setting) when the alarm generated is normal user traffic

### Signature Actions
- Actions include: Generating an alert, Logging the activity, Dropping or preventing the activity, Resetting a TCP connection, Blocking future activity and allowing the activity

### Details on Signature Actions
- Generating an alert: Produce an alert or a verbose alert
- Logging the activity: Log attacker packets, a log pair of packets (attacker and defendant packets), Log victim packets
- Dropping or preventing the activity: Deny attacker inline, deny connection inline,  deny packet inline
- Resetting a TCP connection: Reset a TCP connection
- Blocking future activity: Request block connection, request block host, request SNMP trap
- Allow the activity: Allow the traffic to appear as normal based on configured exceptions

### Secure Device Event Exchange
- Consists of Alarm, SDEE and Syslog protocols that are used by the Network Management Console and the Syslog Server

### IPS Configuration Best Practices
- A firewall and IPS will provide the most effective outcome