Intrusion Prevention Systems (IPS)

Introduction to Intrusion Prevention

• Chapter 5 focuses on implementing intrusion prevention.

IPS Technologies

• Section 5.1 discusses various IPS (Intrusion Prevention System) technologies.
• Students should be able to explain zero-day attacks upon completion of this section
• Students will learn how to monitor, detect, and stop attacks.
• Students will be able to describe the advantages and disadvantages of both Intrusion Detection Systems (IDS) and IPS.

IDS and IPS Characteristics

• An Intrusion Detection System (IDS) operates passively.
• IDS requires network traffic to be mirrored in order to analyze it.
• IDS does not handle network traffic directly unless traffic is mirrored to it.
• An Intrusion Prevention System (IPS) operates inline.
• IPS monitors Layer 3 and Layer 4 traffic.
• IPS can stop single-packet attacks before they reach the target.
• IPS responds immediately to block malicious traffic.
• IPS inspects traffic content at the application layer.
• Both IDS and IPS technologies are deployed as sensors.
• Both IDS and IPS use signatures to detect misuse patterns in network traffic.
• Both IDS and IPS can detect atomic patterns (single-packet) or composite patterns (multi-packet).
• IDS has no impact on network performance.
• IDS is not affected by sensor failures or overloads.
• IDS response action cannot stop the triggering event.
• IPS can stop trigger packets.
• IPS networks are affected by sensor issues or sensor overloading.
• IPS may have some impact on network performance.

Network-Based IPS Implementations

• Host-based IPS protects a specific host operating system
• Host-based IPS provides OS and application-level protection
• Host-based IPS protects a host after the message is Decrypted
• Host-based IPS is operating system dependent and must be installed of all host
• Network-based IPS is cost effective and the operating system is independent.
• Network-based IPS cannot examine encrypted traffic
• Network-based IPS must stop malicious traffic prior to arriving at the host.
• Cisco offers modular and appliance-based IPS solutions, including:
  • Cisco IPS AIM and Network Module Enhanced (IPS NME)
  • Cisco ASA AIP-SSM
  • Cisco IPS 4300 Series Sensors
  • Cisco Catalyst 6500 Series IDSM-2
• Factors affecting IPS sensor selection include:
  • Amount of network traffic
  • Network topology
  • Security budget
  • Available security staff for IPS management
• Network IPS is cost-effective and not visible on the network.
• Network IPS is operating system independent and monitor lower-level network events.
• Network IPS cannot examine encrypted traffic.
• Network IPS cannot determine whether an attack was successful.

Modes of Deployment

• Promiscuous Mode is commonly used with IDS.
• Inline Mode is commonly used with IPS.

Cisco Switched Port Analyzer

• SPAN (Switched Port Analyzer) is used for port mirroring in Cisco networks.
• Monitor sessions can be configured using the monitor session command
• show monitor command is used to verify SPAN sessions.

IPS Signatures

• Section 5.2 overviews IPS signatures.
• Students should understand IPS signature characteristics.
• Students should be able to explain IPS signature alarms.
• Students should be able to manage and monitor IPS.
• Students should understand global correlation of Cisco IPS devices.

IPS Signature Characteristics

• A signature is a set of rules used by IDS and IPS to detect intrusion activity.
• The three main attributes of signatures are Type, Trigger (alarm), and Action.

Signature types

• Atomic signatures are a single packet, activity, or event.
• Composite signatures are a sequence of operations across multiple hosts.

Signature Files

• Signature files package network signatures and must be uploaded to an IPS when new threats are identified.

IPS Signature Alarms

• Pattern-based detection involves easy configuration, fewer false positives, and good signature design.
• Anomaly-based detection provides simple, reliable and customized policies.
• Policy-based detection allows for easy configuration and detection of unknown attacks.
• Honey pot-based detection is a window to viewing attacks, designed to distract confuses attackers and slow down and avert attacks as well as collect information on attacks.
• The disadvantages of Pattern based detections are that have no detection of Unknown signatures, initially there are a lot of false positives and Signatures must be created updated and tuned.
• The disadvantage of Anomaly based detection is that generic Output and Policy must be created.
• The disadvantage of Policy based detections are difficult to profile typical activity in large network, and Traffic profile must be constant.
• Ths disadvantage of Honey pot based detection id that it requires a dedicated honey pot server, and a hot pot server must not be trusted.
• Atomic signatures do not state to examine pattern to determine if a signature action should be applied.
  • Detecting an ARP request with a source Ethernet address of FF:FF:FF:FF:FF:FF would be an example
• Composite signatures must contain state or examine multiple items to determine if signature action should be applied.
• Searching for the string "confidential" across multiple packets in a TCP session. would be an example
• Anomaly based atomic signatures do not need to identify activity that deviates from normal profile; An example would be detecting traffic that is going to a destination port which is non in the normal profile.
• Anomaly based Composite signatures need State required to identify activity that deviates from normal profile; An example would be Verifying protocol compliance for HTTP traffic.
• Policy based Atomic signatures no state or required to identify undesirable behaviour; An example may include Detecting abnormally large fragmented packets by examining only the last fragment.
• Policy based Composite signatures uses a Previous activity (state) required to identify undesirable behaviour; An example may include a Sun Unix host sending RPC requests to remote hosts without initially consulting the Sun PortMapper program.

Alarm triggering Mechanisms

• False positive
• Has a Network Activity of Normal user traffic
• IPS Activity includes Alarm generated
• The outcome is Tune alarm
• False negative
• Has a Network Activity of Attack traffic
• IPS Activity includes No alarm generated
• The outcome is Tune alarm
• True positive
• Has a Network Activity of Attack traffic
• IPS Activity includes Alarm generated
• The outcome is Ideal setting
• True negative
• Has a Network Activity of Normal user traffic
• IPS Activity includes No alarm generated
• The outcome is Ideal setting

Signature Actions

• Generating an alert, Produce alert or Produce verbose alert.
• Logging the activity includes Log attacker packets, Log pair packets, Lor victim packets.
• Dopping or preventing the activity includes Deny attacker inline, Deny connection inline and Deny packet inline.
• Resetting a TCP connection will Reset the TCP connection.
• Blocking future activity includes Request block connection Request block host and Request SNMP trap.
• The activity May be allowed if the action will permit the traffic to appear as normal based on configured exceptions. An example would be allowing alerts from an approved IT scanning host.

Manage and Monitor IPS

• Secure Device Event Exchange (SDEE) and Syslog are use to manage and monitor IPS

IPS Configuration Best Practices

• Configure the Firewall and VPN before implementation IPs