NETWORK SECURITY LAB Lab 9. IDS and IPS

Introduction – IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) increase the security level of network by: • Monitoring traffic • Inspecting and scanning data packets – Inspection and detection is mainly based on the malicious signatures already recognized – Flavors of IDS/IPS: – Software and Hardware – NIDS (Network IDS) – HIDS (Host IDS)

HIDS and NIDS • HIDS: Any antivirus can be considered as a HIDS as it will alert the user the moment a suspicious file or activity is detected. – Hosted on the device per-se – Reports malicious activities immediately to the user. • NIDS: – Strategically placed in the network. – All network devices such as servers, routers, access points and client computers can be inspected for any malicious activity. – Performs regular network traffic analysis – Can store information in Security Information and Event Management System (SIEM) – Alerts the system admin on unusual activities at both inspection and network traffic routines

NIDS – Network Activity Monitoring - Benchmarks & Rules can be configured

HIDS HIDS: - Placed on a single host and not for network Keeps checkpoints for comparison Scans files, file system, logs and software and alerts for the changes as malicious activity

Tools in practice - Industry is inundated with tools for IDS/IPS: - Snort - IBM Qradar (SIEM) - NG – Secure Federated ID - FireEye MVX-IPS - McAfee Security Platform - NSFocus IPS - Secure works –iSensor Intrusion Protection system …

Hands on - Follow the Instruction document in the folder Lab 9 – IDS and IPS for the hands on: - Setting up Snort as IDS on Windows