Intrusion Prevention Systems (IPS)

<existing_notes>
### Chapter 5: Implementing Intrusion Prevention

- This chapter provides an overview of intrusion prevention systems (IPS).

### 5.1 IPS Technologies

- This section covers zero-day attacks, monitoring, detection, stopping attacks and the advantages and disadvantages of IDSs and IPSs.

### 5.1.1: IDS and IPS Characteristics

- Zero-day attacks exploit vulnerabilities before they are known publicly.

### Monitor for Attacks

- Intrusion Detection Systems (IDS) work passively.
- An IDS requires traffic mirroring to analyze it.
- Network traffic doesn't pass through the IDS unless mirrored.

### Detect and Stop Attacks

- Intrusion Prevention Systems (IPS) operate inline.
- An IPS monitors Layer 3 and Layer 4 traffic.
- IPS can stop single-packet attacks to prevent reaching a target.
- IPS responds immediately to block malicious traffic.
- An IPS inspects malicious traffic content at the application layer

### Similarities Between IDS and IPS

- Both intrusion detection systems (IDS) and intrusion prevention systems (IPS) are deployed as sensors.
- Both IDS and IPS use signatures to detect patterns of misuse in network traffic.
- IDS and IPS can detect atomic patterns (single-packet) and composite patterns (multi-packet).

### Advantages and Disadvantages of IDS and IPS

- The advantages of IDS include no impact on the network.
- The advantages of IDS include no network impact if there is a sensor failure or overload.
- The disadvantages of IDS include response actions not stopping the trigger.
- The advantages of IPS include stopping trigger packets.
- The disadvantages of IPS include sensor issues potentially affecting network traffic.
- The disadvantages of IPS include sensor overloading impacting the network and some impact on the network.

### 5.1.2: Network-Based IPS Implementations

- Network-Based IPS implementations and Host-Based IPS Implementations

### Host-Based and Network-Based IPS

- Host-based IPS provides protection specific to a host operating system and application-level protection. It also protects the host after the message is decrypted. However, it's operating system-dependent and must be installed on all hosts.
- Network-Based IPS is cost-effective and operating system-independent. However, it cannot examine encrypted traffic and must stop malicious traffic before it reaches the host.

### Network-Based IPS Sensors

- A corporate network is protected from untrusted network with firewall and sensors in place

### Cisco’s Modular and Appliance-Based IPS Solutions

- Cisco offers various IPS solutions, including IPS AIM, Network Module Enhanced (IPS NME), ASA AIP-SSM, IPS 4300 Series Sensors, and Catalyst 6500 Series IDSM-2.

### Choose an IPS Solution
- Factors affecting IPS sensor selection and deployment are the amount of network traffic, the network topology, the security budget, and the availability of security staff.

### IPS Advantages and Disadvantages
- Network IPS is cost-effective, not visible on the network, operating system independent, and able to see lower-level network events.
- Network IPS cannot examine encrypted traffic and cannot determine whether an attack was successful.

### Modes of Deployment
- Promiscuous mode is associated with IDS
- Inline mode is associated with IPS

### 5.1.3: Cisco Switched Port Analyzer

- Cisco Systems provides SPAN (Switched Port Analyzer) for port mirroring.

### Port Mirroring

- Traffic can be analyzed using a hub by sniffing the traffic

### Cisco SPAN

- Traffic can be analysed using a switch to copy the traffic to a port analyzer

### Configuring Cisco SPAN Using Intrusion Detection

- Configuring Cisco SPAN uses the monitor session command to associate a source port and a destination port with a SPAN session.
- The show monitor command is used to verify the SPAN session.

### 5.2: IPS Signatures

- Covers IPS signature characteristics, IPS signature alarms, managing and monitoring IPS and understanding the global correlation of Cisco IPS devices.

### 5.2.1: IPS Signature Characteristics

- A signature is a set of rules used by IDS and IPS to detect intrusions.
- Signatures have three attributes: type, trigger (alarm), and action.

### Signature Types

- Atomic signatures consist of a single packet, activity, or event.
- Composite signatures identify a sequence of operations distributed across multiple hosts over time.

### Signature File

- New signatures are created and uploaded to an IPS as new threats are identified.
- A signature file contains a package of network signatures.

### Download a Signature File

- A signature file can be downloaded

### 5.2.2: IPS Signature Alarms

- Explanation of IPS signature alarms

### Signature Alarm

- Detection types include pattern-based detection, anomaly-based detection, policy-based detection, and honey pot-based detection.
- Pattern-based detection is easy to configure and has fewer false positives.
- Anomaly-based detection is simple, reliable, and uses customized policies.
- Policy-based detection is easy to configure and can detect unknown attacks.
- Honey pot-based detection provides a window to view attacks, distracts/confuses attackers, slows down/averts attacks, and collects information about attacks.

### Pattern-Based Detection

- Atomic signatures don't require state to examine patterns.
- Composite Signatures must contain state or examine multiple items to determine if signal action should be applied

### Anomaly-Based Detection
- State is required to identify activity that deviates from normal profile for composite signature type

### Policy-Based and Honey Pot-Based Detection
- State is not required to identify undesirable behavior for atomic signatures

### Alarm Triggering Mechanisms

- Alarm types are detailed along with their associated network activity, IPS activity, and outcomes.
- A false positive, normal user traffic triggers alarm generation, requiring alarm tuning.
- A false negative refers to attack traffic not generating an alarm, also requiring tuning.
- A true positive is attack traffic generating an alarm, which is ideal.
- A true negative represents normal user traffic not triggering an alarm, which is ideal.

### 5.2.3: IPS Signature Actions

- Covers the summary of action categories

### Signature Actions

- Action categories are defined, including generating an alert, logging activity, dropping or preventing activity, resetting a TCP connection, blocking future activity, and allowing activity.

### 5.2.4: Manage and Monitor IPS

- Covers everything to do with management and monitoring of IPS

### Secure Device Event Exchange

- Syslog and SDEE protocol is used in secure divide event exchange

### IPS Configuration Best Practices
- VPN, ESA/WSA, Webserver, Email server and DNS with firewall and IPS in place
</existing_notes>