1. Intrusion Detection Systems Austen Hayes Cameron Hinkel

2. Intrusion Detection Systems (IDS) Definition

3. Purpose of IDS Monitor Host/Network

4. Purpose of IDS Monitor Host/Network Log Suspicious Activity

5. Purpose of IDS Monitor Host/Network Log Suspicious Activity Detect Potential Threats

6. Purpose of IDS Monitor Host/Network Log Suspicious Activity Detect Potential Threats Alert System Administrator(s)

7. Purpose of IDS Monitor Host/Network Log Suspicious Activity Detect Potential Threats Alert System Administrator(s) Generate Reports

8. Detection Methods Statistical Anomaly-Based

9. Detection Methods Statistical Anomaly-Based ◦ Protocol Analysis

10. Detection Methods Statistical Anomaly-Based ◦ Protocol Analysis ◦ Bandwidth

11. Detection Methods Statistical Anomaly-Based ◦ Protocol Analysis ◦ Bandwidth ◦ Hardware Connections

12. Detection Methods Statistical Anomaly-Based ◦ Protocol Analysis ◦ Bandwidth ◦ Hardware Connections Signature-Based

13. Detection Methods Statistical Anomaly-Based ◦ Protocol Analysis ◦ Bandwidth ◦ Hardware Connections Signature-Based Stateful Protocol Analysis

14. Types of IDS Network (NIDS) NIDS Firewall Internet Private Network

15. Types of IDS Host-based (HIDS) Firewall Internet Private Network HIDS

16. Types of IDS Wireless IDS Sensor Access Point Wireless Devices Internet

17. Types of IDS Network (NIDS) Host-based (HIDS) Wireless Network Behavior Analysis

18. Network IDS Installation Types ◦ Hub/Switch NIDS Hub Internet Private Network

19. Network IDS Installation Types ◦ Network Tap NIDS Hub Internet Private Network

20. Network IDS Installation Types ◦ Inline Internet NIDS Hub Private Network

21. Network IDS Examples ◦ “LaBrea Tarpit”  Propagation of worms

22. Network IDS Examples ◦ “LaBrea Tarpit”  Propagation of worms  ARP request responses

23. Network IDS Examples ◦ Honey Pot  Low-Interaction

24. Network IDS Examples ◦ Honey Pot  Low-Interaction  High-Interaction

25. Types of Attacks

26. Port Scan

27. Types of Attacks Port Scan DOS Attack

28. Types of Attacks Port Scan DOS Attack ICMP Flood

29. Types of Attacks Port Scan DOS Attack ICMP Flood Distributed

30. Popular IDS Software Snort ◦ Open source, Signature-based

31. Popular IDS Software Snort ◦ Open source, Signature-based AIDE ◦ Advanced Intrusion Detection Environment

32. Popular IDS Software Snort ◦ Open source, Signature-based AIDE ◦ Advanced Intrusion Detection Environment OSSEC HIDS

33. Conclusion Security Integral to Sys. Admin Job

34. Conclusion Complexity of Securing A System/Network

35. Conclusion Security Integral to Sys. Admin Job Complexity of Securing a System/Network Numerous Tools Available To Detect Threats