18 Questions
What is a limitation of HIDPS in terms of attack detection?
It is not aware of attacks that span multiple devices in the network
What type of detection method involves examining network traffic for known attack patterns?
Signature-based detection
What is the primary goal of tuning an IDPS?
To minimize false positives and false negatives
What is a potential problem with signature-based detection?
It is not effective against unknown attacks
What type of IDPS resides on a computer or appliance connected to a segment of an organization's network?
Network-based IDPS
What type of detection method involves collecting statistical summaries of normal network traffic?
Anomaly-based detection
Why might an HIDPS require additional disk capacity?
To retain host OS audit logs
What is a true attack stimulus in the context of IDPS?
An event that triggers an alarm and causes an IDPS to react as if a real attack is in progress
What type of attack is an HIDPS susceptible to?
Denial of Service (DoS) attacks
What is site policy awareness in the context of IDPS?
An IDPS's ability to dynamically modify its configuration in response to environmental activity
What is a limitation of a wireless NIDPS?
It cannot evaluate and diagnose issues with higher-layer protocols like TCP and UDP.
What is the primary function of a network-based IDPS?
To monitor traffic on a specific segment of the network and identify attacks
Where are sensors for wireless networks typically located?
On specialized sensor components or incorporated into selected mobile stations.
What type of IDPS monitors activity only on a particular computer or server?
Host-based IDPS
What is the purpose of site policy in the context of IDPS?
To provide guidelines for IDPS implementation and operation
What is a capability of a wireless NIDPS?
Detecting unauthorized WLANs and WLAN devices.
What is a host-based IDPS also known as?
System integrity verifiers
What is a limitation of NIDPSs?
They require ongoing effort by the network administrator to evaluate logs of suspicious network activity.
Study Notes
IDPS Detection Methods
- IDPSs use signature-based detection, anomaly-based detection, and stateful protocol analysis to monitor and evaluate network traffic.
Signature-Based Detection
- Examines network traffic for patterns that match known signatures or predetermined attack patterns.
- Widely used because many attacks have clear and distinct signatures.
- New attack patterns must be continually added to the IDPS's database of signatures to recognize new strategies.
Anomaly-Based Detection
- Collects statistical summaries by observing traffic known to be normal.
- Establishes a performance baseline over a period of time known as the training period.
IDPS Terminology
- Site policy: rules and configuration guidelines governing IDPS implementation and operation within an organization.
- Site policy awareness: an IDPS's ability to dynamically modify its configuration in response to environmental activity.
- True attack stimulus: an event that triggers an alarm and causes an IDPS to react as if a real attack is in progress.
- Tuning: adjusting an IDPS to maximize its efficiency in detecting true positives while minimizing false positives and false negatives.
Types of IDPS
- Network-Based IDPS (NIDPS):
- Resides on a computer or appliance connected to a network segment.
- Monitors traffic on that segment, looking for indications of ongoing or successful attacks.
- Cannot reliably ascertain whether an attack was successful.
Wireless NIDPS
- Monitors and analyzes wireless network traffic, looking for potential problems with wireless protocols (Layers 2 and 3 of the OSI model).
- Cannot evaluate and diagnose issues with higher-layer protocols like TCP and UDP.
- Can detect: unauthorized WLANs and WLAN devices, poorly secured WLAN devices, unusual usage patterns, wireless network scanners, DoS attacks and conditions, impersonation and man-in-the-middle attacks.
Host-Based IDPS (HIDPS)
- Resides on a particular computer or server (the host) and monitors activity only on that system.
- Known as system integrity verifiers because they benchmark and monitor the status of key system files and detect when an intruder creates, modifies, or deletes monitored files.
- May require adding disk capacity to the system to retain host OS audit logs.
- Not aware of attacks that span multiple devices in the network without complex correlation analysis.
- Susceptible to some DoS attacks.
Understand the key concepts and policies related to Intrusion Detection and Prevention Systems (IDPS). Learn about site policy, dynamic IDPS, and true attack stimulus.
Make Your Own Quizzes and Flashcards
Convert your notes into interactive study material.
Get started for free
