Intrusion Prevention Systems (IPS)

Chapter 5: Implementing Intrusion Prevention

• This chapter is about implementing intrusion prevention
• The chapter covers IPS Technologies, IPS Signatures and implementation
• The chapter concludes with a Summary

IPS Technologies

• This section covers zero-day attacks, how to monitor, detect and stop attacks
• Also looks at the advantages and disadvantages of IDS and IPS

IDS and IPS Characteristics

• Zero-day attacks are exploits that occur before a patch is available

Monitoring for Attacks

• Intrusion Detection System (IDS) works passively
• IDS requires traffic to be mirrored to reach it
• Network traffic doesn't pass through the IDS unless mirrored

Detecting and Stopping Attacks

• Intrusion Prevention System (IPS) operates in inline mode
• IPS monitors Layer 3 and Layer 4 traffic
• IPS can stop single packet attacks from reaching the target
• IPS responds immediately, preventing malicious traffic from passing

IPS

• IPS inspects and blocks malicious traffic content at the application layer

Similarities Between IDS and IPS

• Both IDS and IPS are deployed as sensors
• Both use signatures to detect misuse patterns in network traffic
• Both can detect atomic (single-packet) or composite (multi-packet) patterns

Advantages and Disadvantages of IDS and IPS

• IDS has no impact on the network and isn't impacted by sensor failures or overloads
• IDS cannot stop the trigger response
• IPS stops trigger packets
• Sensor issues or overloading can affect network traffic and potentially impact the network and IPS has some impact on network

Network-Based IPS Implementations

• Host-based IPS provides protection specific to a host operating system
• Host-based IPS also provides operating system and application level protection
• Host-based IPS protects the host after message decryption
• A disadvantage of Host-based IPS is that it is Operating system dependent
• Network-based IPS is cost-effective and operating system independent
• A disadvantage of Network-based IPS is that it cannot examine encrypted traffic
• Another disadvantage of Network-based IPS is that it must stop malicious traffic prior to arriving at host

Network-Based IPS Sensors

• Network-based IPS sensors are placed within the network to monitor traffic

Cisco’s Modular and Appliance-Based IPS Solutions

• Cisco offers modular and appliance-based IPS solutions
• Examples include Cisco IPS AIM, Network Module Enhanced (IPS NME), ASA AIP-SSM etc...

Choosing an IPS Solution

• Factors to consider for IPS sensor selection include network traffic amount, network topology, security budget, and available security staff

IPS Advantages and Disadvantages

• Network IPS is cost-effective, not visible on the network, and OS independent
• Network IPS sees lower-level network events
• Network IPS cannot examine encrypted traffic or determine if an attack was successful

Modes of Deployment

• Promiscuous Mode is used in IDS
• Inline Mode is used in IPS

Cisco Switched Port Analyzer

• Cisco Switched Port Analyzer is a feature for port mirroring

Configuring Cisco SPAN Using Intrusion Detection

• The monitor session command associates a source and destination port with a SPAN session
• The show monitor command verifies the SPAN session

IPS Signatures

• Understand IPS signature characteristics
• Explain IPS signature alarms
• Manage and monitor IPS
• Understand the global correlation of Cisco IPS devices

IPS Signature Characteristics

• A signature is a set of rules for IDS/IPS to detect typical intrusion activity
• Signatures have Type, Trigger (alarm), and Action attributes.

Signature Types

• Atomic signatures consist of a single packet, activity, or event
• Composite signatures identify a sequence of operations across multiple hosts over time

Signature File

• New signatures must be created and uploaded to an IPS as new threats are identified
• A signature file contains a package of network signatures

IPS Signature Alarms

• Signature alarms come from various detection types:

Detection Type

• Pattern-based detection uses easy configuration, fewer false positives, and good signature design,
• Anomaly-based detection is simple and reliable with customized policies.
• Policy-based detection offers easy configuration and detects unknown attacks.
• Honey pot-based detection provides a window to view attacks, distract attackers, slow down attacks, and collect information.

Signature Type

• Atomic signatures require no state to examine patterns
• Composite signatures need state or multiple items to determine signature action

Anomaly-Based Detection Signature Type

• Atomic signatures need no state to identify activity that deviates from a normal profile
• Composite signatures require state to identify activity that deviates from a normal profile

Alarm Triggering Mechanisms

• False positive: Normal traffic triggers an alarm, addressed by tuning the alarm
• False negative: An attack occurs, but triggers no alarm, addressed by tuning the alarm
• True positive: An attack occurs and generates an alarm, representing the ideal setting.
• True negative: Normal traffic occurs, triggering no alarm and representing the ideal setting.

IPS Signature Actions

• Action categories include generating alerts, logging activity, dropping/preventing activity, resetting TCP connections, blocking future activity, and allowing activity

Managing and Monitoring IPS

• Actions include producing alerts (verbose or non-verbose), logging attacker/pair/victim packets, denying attackers inline, and resetting TCP connections

Actions for Controlling Traffic

• Actions for controlling traffic include requesting block connections/hosts, requesting SNMP traps, or allowing traffic based on configured exceptions (e.g., approved IT scanning hosts)

Secure Device Event Exchange

• Secure Device Event Exchange is used for alarms
• SDEE protocol and Syslog used for network management console and syslog servers

IPS Configuration Best Practices

• The is a example topology which includes, VPN, Firewall,IPS, Web Server, DNS and Email Servers