Section 16.149 IDS and IPS

Question 1

Key difference iDS V IPS

Intrusion Detection Systems (IDS)

Answer 1

Logs and alerts

Question 2

Key Difference IDS V IPS

Intrusion prevention systems (IPS)

Answer 2

Logs, alerts, and takes action

Question 3

Network Intrusion Detection Systems (NIDS)

Answer 3

Responsible for detecting unauthorised network access or attacks

These Systems are designed to either verify, itemise, categorise and report ona threat.

Only detects and reports doesn’t prevent attacks

Question 4

3 Types of Intrusion Detection Systems (IDS)

Network-based IDS (NIDS)

Answer 4

Monitors the traffic coming in and out of a network

Question 5

3 Types of Intrusion Detection Systems (IDS)

Host-based IDS (HIDS)

Answer 5

Looks at suspicious network traffic going to or from a single or endpoint

Question 6

3 Types of Intrusion Detection Systems (IDS)

Wireless IDS (WIDS)

Answer 6

Detects attempts to cause a denial of a service on a wireless network

Question 7

Signature-based IDS

Intrusion detection systems operate either using signature-based or anomaly-based detection algorithms

Answer 7

Analyses traffic based on defined signatures and can only recognise attacks based on previously identified attacks in its database

Pattern-matching:
● Specific pattern of steps recognised during an attack
● NIDS, WIDS

Stateful-matching:
● Known system baseline
● HIDS

Question 8

Anomaly-based IDS

Intrusion detection systems operate either using signature-based or anomaly-based detection algorithms

Answer 8

Analyses traffic and compares it to a normal baseline of traffic to determine whether a threat is occurring

Question 9

IPS and IDS placement

Answer 9

For a network IPS, we want to have the device placed right near the border of the network, right behind your firewall. That way, we have all the traffic funneling right through it so it can stop and block things as needed.

A NIDS, on the other hand,
should be attached through a mirrored port off the backbone switch. This way, it can analyze all the traffic in a passive manner.