Lecture 10 Pt. 1 Flashcards
What does IPS stand for?
Intrusion Prevention System
What is the main function of an IDS is to _________ and _______ anomalous or malicious activity
To monitor and detect anomalous or malicious activity
What is the main function of an Intrusion Prevention System (IPS)?
To detect and prevent malicious traffic
Fill in the blank: An IDS is primarily a d______ solution.
diagnostic
What are the two types of detection used by IDS and IPS?
- Signature-based detection
- Anomaly-based detection
True or False: An IDS can block malicious traffic.
False
What is the difference between a Network Intrusion Detection System (NIDS) and a Host Intrusion Detection System (HIDS)?
- NIDS monitors traffic across multiple sensor points
- HIDS is placed directly on devices to monitor traffic
What action does an IPS take when it detects malicious traffic?
It can block and log the malicious traffic
What does ‘Defense-in-Depth’ refer to in network security?
A strategy that uses multiple layers of security controls
What are the actions that can be taken in Snort IDS mode?
- Alert
- Log
- Pass
What additional action does an IPS take compared to IDS?
Block malicious traffic
Fill in the blank: Anomaly-based IDS solutions detect threats based on _______ patterns.
suspicious behavior
What is the purpose of Application Protocol-based Intrusion Detection Systems (APIDS)?
To monitor traffic across specific application layer protocols
What does a Wireless Intrusion Prevention System (WIPS) monitor?
Wireless networks owned by an organization
How does an IPS differ from an IDS in terms of response to threats?
IPS can autonomously stop threats before they cause damage
True or False: IDS can operate without human intervention.
False
What is the role of a Network Behavioral Analysis (NBA) system?
To detect anomalous behavior within network patterns
‘signature-based detection’ uses ___-_______ signatures to identify known threats
It uses pre-existing signatures to identify known threats
An ‘alert’ is triggered in IDS when potentially _ _ _ _ _ _ _ _ _ or _ _ _ _ _ _ _ _ _ _ _ activty is detected on the network or host
An alert is a message or notification triggered by the IDS when it detects potentially malicious or unauthorized activity on the network or host.
Fill in the blank: An IPS typically operates in the same network location as a _______.
firewall
What are some examples of IDS technologies mentioned?
- SNORT
- Cisco NGIDS/IPS
- Security Onion
What does the term ‘malicious traffic’ refer to?
Traffic that is harmful or intended to compromise network security
What is the purpose of a Web Application Firewall (WAF)?
To address specific web application attacks
What kind of detection does a Protocol-based Intrusion Detection System (PIDS) perform?
A analyzes protocol-specific traffic for signs of misuse or anomaly.
