Lesson 6 Flashcards
Attempts to gain entry to a system.
Intrusion
Activities that deter intrusion.
Intrusion Prevention
Procedures, detect system intrusions.
Intrusion Detection
Actions when an intrusion occurs.
Intrusion Reaction
Restoration of operations.
Intrusion Correction Activities
– detect violations and activate the alarm.
– notify administrators of trouble.
– notify external security services.
Intrusion Detection & Prevention Systems
IDPS Terminologies (12)
Site Policy Awareness
Tuning
True Attack Stimulus
Confidence Value
Alarm Filtering
Alarm Clustering & Compaction
Alert/Alarm
Evasion
False Attack Stimulus
False Negative & False Positive
Noise
Site Policy
– protecting network information assets.
– connected to a segment of a network.
– looks for attack patterns in packets.
– installed where it can watch traffic.
– done through special TCP/IP stacks (where data packets are invalid or used improperly).
Network-based IDPS
For wireless networks.
Ex. physical security, sensor range, switch
Wireless IDPS
Examines traffic flow, abnormal patterns.
Ex. DoS, scanning, worms, violations
Network Behavior Analysis IDPS
Advantages of NIDPS (3)
Can use devices to monitor larger networks, passive and can be deployed into existing networks, not susceptible and detectable by attacks.
Disadvantages of NIDPS (5)
Can be overwhelmed by network volume, require access to all traffic, cannot analyze encrypted packets, cannot ascertain if an attack is successful, bad for fragmented packets.
Disadvantages of NIDPS (4)
Can be overwhelmed by network volume, require access to all traffic, cannot analyze encrypted packets, cannot ascertain if an attack is successful, bad for fragmented packets.
– resides on a server.
– benchmark and monitor key files.
– detects intruders modifying files.
– principle of configuration.
– change management.
Host-based IDPS
– resides on a server.
– benchmark and monitor key files.
– detects intruders modifying files.
– principle of configuration.
– change management.
Host-based IDPS
Advantages of HIDPS (6)
installed, access encrypted network, detect local events, functions on host systems where traffic is decrypted, not affected by switch networks, detect inconsistencies through audit logs.
Disadvantages of HIDPS (5)
Management issues, vulnerable to direct and host-targeted attacks, susceptible to DoS, large disk space, performance overhead.
– examine patterns that match signatures.
– attacks have distinct signatures.
– must be continuously updated.
Signature-based IDPS
– AKA stat IDPS or behavior-based IDPS.
– compare traffic known to be normal.
– baseline parameters/clipping level.
– can detect new attacks.
– requires more overhead.
– may generate false positives.
Statistical Anomaly-based IDPS
– stores relevant data involving multiple attack requests (detect multi-session attacks).
– analytical complexity, may fail to detect unless a protocol is violated.
Stateful Protocol Analysis IDPS
Comparing predetermined profiles.
Stateful Protocol Analysis
– similar to NIDPS.
– reviews log files for patterns or signs.
– allocation of resources for log data.
Log File Monitor
– systems environment?
– security goals and objectives?
– existing security policy?
Technical Policy Considerations
