Module 11 Flashcards
____ is a cyberattack that tries to exploit software vulnerabilities that are unknown or undisclosed by the software vendor, as shown in the figure.
____ describes the moment when a previously unknown threat is identified.
____ depicted as a red skull and crossbones trying to enter a LAN through a firewall
A zero-day attack, sometimes referred to as a zero-day threat,
_____ were implemented to passively monitor the traffic on a network.
Intrusion Detection Systems (IDS)
Working offline, the IDS compares the captured traffic stream with known malicious signatures, similar to software that checks for viruses. Working offline means several things:
The IDS works passively.
The IDS device is physically positioned in the network so that traffic must be mirrored in order to reach it.
Network traffic does not pass through the IDS unless it is mirrored.
Very little latency is added to network traffic flow.
Although the traffic is monitored, logged, and perhaps reported, no action is taken on packets by the IDS. This offline IDS implementation is referred to as ____
promiscuous mode.
The ___ of operating with a copy of the traffic is that the IDS does not negatively affect the packet flow of the forwarded traffic.
advantage
The ____ of operating on a copy of the traffic is that the IDS cannot stop malicious single-packet attacks from reaching the target. An IDS often requires assistance from other networking devices, such as routers and firewalls, to respond to an attack.
disadvantage
a device that can immediately detect and stop an attack
Intrusion Prevention System (IPS)
Common Characteristics of IDS and IPS
Malicious traffic is sent to the target host that is inside the network.
The traffic is routed into the network and received by an IPS-enabled sensor where it is blocked.
The IPS-enabled sensor sends logging information regarding the traffic to the network security management console.
The IPS-enabled sensor kills the traffic. (It is sent to the “Bit Bucket.”)
Both technologies are deployed as sensors.
Both technologies use signatures to detect patterns of misuse in network traffic.
Both can detect atomic patterns (single-packet) or composite patterns (multi-packet).
IDS and IPS technologies are both deployed as sensors. An IDS or IPS sensor can be in the form of several different devices:
A router configured with IPS software
A device specifically designed to provide dedicated IDS or IPS services
A hardware module installed in an adaptive security appliance (ASA), switch, or router
IDS and IPS technologies use ___ to detect patterns in network traffic.
A ___ is a set of rules that an IDS or IPS uses to detect malicious activity. ___ can be used to detect severe breaches of security, to detect common network attacks, and to gather information.
signatures
IDS and IPS technologies can detect
atomic signature patterns (single-packet) or composite signature patterns (multi-packet).
IDS Advantages
No impact on network (latency, jitter)
No network impact if there is a sensor failure
No network impact if there is sensor overload
IDS Disadvantages
Response action cannot stop trigger packets
Correct tuning required for response actions
More vulnerable to network security evasion techniques
IPS Advantages
Stops trigger packets
Can use stream normalization techniques
IDS Disadvantages
Sensor issues might affect network traffic
Sensor overloading impacts the network
Some impact on network (latency, jitter)
IDS Advantages
An IDS is deployed in offline mode and therefore:
The IDS does not impact network performance. Specifically, it does not introduce latency, jitter, or other traffic flow issues.
The IDS does not affect network functionality if the sensor fails. It only affects the ability of the IDS to analyze the data.
IDS Disadvantages
Disadvantages of an IDS include:
An IDS sensor cannot stop the packets that have triggered an alert and are less helpful in detecting email viruses and automated attacks, such as worms.
Tuning IDS sensors to achieve expected levels of intrusion detection can be very time-consuming.
Users deploying IDS sensor response actions must have a well-designed security policy and a good operational understanding of their IDS deployments.
An IDS implementation is more vulnerable to network security evasion techniques because it is not inline.
IPS Advantages
Advantages of an IPS include:
An IPS sensor can be configured to drop the trigger packets, the packets associated with a connection, or packets from a source IP address.
Because IPS sensors are inline, they can use stream normalization. Stream normalization is a technique used to reconstruct the data stream when the attack occurs over multiple data segments.
IPS Disadvantages
Disadvantages of an IPS include:
Because it is deployed inline, errors, failure, and overwhelming the IPS sensor with too much traffic can have a negative effect on network performance.
An IPS sensor can affect network performance by introducing latency and jitter.
An IPS sensor must be appropriately sized and implemented so that time-sensitive applications, such as VoIP, are not adversely affected.
Deployment Considerations
You can deploy both an IPS and an IDS. Using one of these technologies does not negate the use of the other. In fact, IDS and IPS technologies can complement each other.
For example, an IDS can be implemented to validate IPS operation because the IDS can be configured for deeper packet inspection offline. This allows the IPS to focus on fewer but more critical traffic patterns inline.
Deciding which implementation to use is based on the security goals of the organization as stated in their network security policy.
More vulnerable to network security evasion techniques enabled by various network attack methods
IDS
Can affect network performance by introducing latency and jitter
IPS
Must be implemented so that time-sensitive applications are not adversely affected
IPS
Cannot stop the trigger packet and is not guaranteed to stop a connection
IDS
Deployed in offline mode
IDS
Can use stream normalization techniques to reduce or eliminate many of the network security evasion capabilities that exist
IPS
Can be configured to perform a packet drop to stop the trigger packet
IPS
Primarily focused on identifying possible incidents, logging information about the incidents, and
reporting the incidents
IDS
Must be deployed inline, and traffic must be able to pass through it
IPS
Less helpful in stopping email viruses and automated attacks, such as worms
IDS
There are two primary kinds of IPS available:
host-based IPS and network-based IPS.
____ is software installed on a host to monitor and analyze suspicious activity.
Host-based IPS (HIPS)
Advantages of Host-based IPS (HIPS)
Provides protection specific to a host operating system
Provides operating system and application level protection
Protects the host after the message is decrypted
Disadvantages of Host-based IPS (HIPS)
Operating system dependent
Must be installed on all hosts
A _____ can be implemented using a dedicated or non-dedicated IPS device such as a router. ___ implementations are a critical component of intrusion prevention.
network-based IPS
