Chapter 7 Flashcards
What is IDPS?
Intrusion Detection Prevention System
Types of IDPS?
NIDPS
WIDPS
HIDPS
What is NIDPS
Network based IDPS
In organizations network, looks for signs of attacks using special implementation of NIDPS for invalid data packets, checks for packets with improper use
Some pros of NIDPS?
When implemented enables organization to use a few devices to monitor large network
Not susceptible to direct attack and may not be detectable by attackers
Cons of NIDPS?
Cannot scan encrypted packets
Requires access to all traffic to be monitored
What is WNIDPS?
Wireless NIDPS
Monitors wireless network traffic
What is HIDPS?
Host based IDPS
Resides on a particular server and monitors only on that system.
Advantage HIDPS over NIDPS?
Can be installed so that it can access data encrypted when traveling over network
Cons of HIDPS?
Management issues
Does not detect multihost scanning
IDPS Detection Methods?
Signature Based IDPS
Statistical anomaly based
Stateful protocol
Log file monitors
What is signature based IDPS?
Checks data traffic with the patterns that match known signatures.
What is Statistical Anomaly IDPS?
Samples network activity
What are the 3 IDPS control strategies?
Centralized
Fully distributed
Partially distributed
What is a centralized control strategy?
All IDPS control functions are implemented and managed in a central location
What is a Fully Distributed?
All control functions are applied at the physical location of each IDPS component.
What is partially distributed?
Combines centralized and fully distributed. Analyze local threats report at the hierarchical central facility to enable threat attacks
What is a honeypot?
A server decoy for the attackers. Designed to lure attackers from critical systems
What is a honeynet?
Collection of honeypots connecting several honey pot system on a subnet
What is a padded cell?
A more protected honeypot.
Advantages of padded cell?
Attackers get diverted to targets they cannot damage
Admins get more time to decide how to respond
What is a footprinting?
An action that researches of internet addresses owned by an organization
What is a fingerprinting?
A systematic survey of all target internet addresses collected in footprinting
Why is fingerprinting useful?
Fingerprinting reveals useful information about internal structure of an attack.
What is a port scanner?
A port scanner can be used by both of the attackers and defenders to identify computers active on a network and other useful information.
