1. NETWORK SECURITY LAB
Lab
9. IDS and IPS

2. Introduction
– IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) increase the security level of network by:
• Monitoring traffic
• Inspecting and scanning data packets
– Inspection and detection is mainly based on the malicious signatures already recognized
– Flavors of IDS/IPS:
– Software and Hardware
– NIDS (Network IDS)
– HIDS (Host IDS)

3. HIDS and NIDS
• HIDS: Any antivirus can be considered as a HIDS as it will alert the user the moment a suspicious file or activity is detected.
– Hosted on the device per-se
– Reports malicious activities immediately to the user.
• NIDS:
– Strategically placed in the network.
– All network devices such as servers, routers, access points and
client computers can be inspected for any malicious activity.
– Performs regular network traffic analysis
– Can store information in Security Information and Event
Management System (SIEM)
– Alerts the system admin on unusual activities at both inspection and
network traffic routines

4. NIDS – Network Activity Monitoring-
Benchmarks & Rules can be configured

5. HIDS HIDS: - Placed on a single host and not for network
Keeps checkpoints for comparison
Scans files, file system, logs and software and alerts for the changes as
malicious activity

6. Tools in practice - Industry is inundated with tools for IDS/IPS:
- Snort
- IBM Qradar (SIEM)
- NG – Secure Federated ID
- FireEye MVX-IPS
- McAfee Security Platform
- NSFocus IPS
- Secure works –iSensor Intrusion Protection system …

7. Hands on
- Follow the Instruction document in the folder Lab 9 – IDS and IPS for the hands on:
- Setting up Snort as IDS on Windows