Many security professionals incorporate
a network based intrusion detection system, or IDS.
Or a network based intrusion prevention system,
or IPS on their networks.
This is designed to watch traffic
going through the network and if this device identifies
an exploit against an operating system, that identifies
a buffer overflow, a database injection, a cross-site script,
it's either going to inform you that that happened
if you're using an IDS or block the traffic if you're
using an IPS.
And that is the most significant difference
between an IDS and an IPS.
With an intrusion detection system,
you'll simply receive an alarm or an alert.
Whereas an intrusion prevention system
has the capability to stop that intrusion before it
gets onto your network.
There are many different ways to engineer
your IPS into your network.
One way is to configure it as a passive monitoring device.
This means that the IPS will receive a copy of the traffic
and be able to then make a decision on what
to do once it's received that information.
Because it is acting as a passive monitor,
it's obviously not sitting in the middle of the communication
and able to block traffic.
You might have traffic going from one device to another
and as it's passing through the switch,
a copy is sent to the IPS.
If something is identified in the middle
of this communication, you may be
able to have the IPS inform you that it saw the intrusion
but obviously the traffic has already
passed through your network to the other device.
The only possibility that you might
have when you're in a passive mode
is to be able to send what's called an out-of-band response.
It's an out-of-band response because the IPS is not
part of the traffic flow, it's sitting out
of the band of the communication.
If traffic does traverse the network
and the IPS receives a copy and determines that that traffic is
malicious, it can send a TCP reset frame
to both the source of the communication
and the destination.
This TCP reset will close the session between these two
devices and they will no longer be
able to send traffic to each other
unless they set up another traffic flow between the two
devices.
This is obviously done after the fact.
And you're hoping that you're able to stop this communication
before much of the malicious state
is able to traverse the network.
This also has very limited capabilities
if there are protocols other than TCP.
For example, UDP doesn't allow to perform a reset.
If this is a UDP communication, there's
no way to stop this communication if you're
sitting in an out-of-band mode.
If a security professional is looking
for more control over these traffic flows then
they'll probably configure their IPS for in-line monitoring.
All traffic then is going to pass through the IPS
and the IPS is going to make a decision
on whether that traffic is allowed through the network
or not.
Because the IPS is sitting inline,
the response to any type of malicious traffic
will be to drop this immediately at the IPS
and not allow it to traverse the network.
There are many different ways to look
for malicious traffic going through your IPS
and not all IPS' will use all of these methods.
One of the most common is a signature based identification
where a signature is predefined inside of the IPS
and it's watching for traffic to traverse the network that
matches this signature exactly.
And if it identifies traffic that
matches exactly what we're seeing,
it will block that traffic at the IPS.
Another method of identification is through anomaly based.
Your IPS will sit on the network and begin
to understand what a normal traffic
flow is for your network.
If any traffic comes through that
doesn't match the normal flow of traffic,
the anomaly based identification will block it at the IPS.
The IPS may have the capabilities
to look for certain behaviors.
If a user deletes a file or changes things on a server,
the IPS may be configured to look for that behavior
and if it occurs, it can block it at the IPS.
And some of the more advanced intrusion prevention systems
can identify attacks based on heuristics.
Instead of using a specific set of signatures,
the IPS could be configured with a set of characteristics
that might define an attack.
As traffic is coming through, the heuristics
can then examine that traffic and make a determination on
if an attack is taking place or not.
An IPS makes the decision on what vulnerabilities
to look for and what to do if a vulnerability is found
based on a series of rules.
You define what the IPS is looking for
based on up to thousands of different rules
that might be in this rule base.
The rules are usually grouped together
by different characteristics and you
can make some broad settings to say
anything that's a database injection,
you may want to block.
But anything that's malware you may want to send an alert.
This can really take a lot of time
to find exactly the right balance of what
you'd like to do.
An intrusion prevention system can
create a number of false positives
and create a large number of alerts.
So you have to find exactly the right number of rules
that you'd like to look for and be
able to configure your IPS for the type of traffic that
works for you.
Here's a page of IPS rules I took from PF since firewall.
You can see the signature 105 for example, uses TCP.
If it identifies port 2589 over a source port
that's going to any destination port,
then there is a signature that identifies
that as a back door that is created by a malware
called dagger.
And you can see that this goes on and on.
There are thousands of rules that you can configure.
And it's up to you to enable the rules that
are important for you and then determine
what the disposition of each one of these rules is going to be.
A significant challenge you have with intrusion prevention
systems is that they're going to give you a lot of alerts
and a lot of messages.
And unfortunately, a number of these messages
are not going to be accurate.
We call these false positives, where the system has told us
that there has been an intrusion onto the network
but in reality it's a case of mistaken identity
and there was not an intrusion at all.
If this is a signature based IPS, then these messages
that you're going to receive from the IPS
are only going to be as good as those signatures.
The more advanced and complex signatures
are probably going to provide you with fewer false positives.
Unfortunately, it can be very time consuming
to go through every single alert and message you
get through the IPS.
But unless you have a way to research these,
you'll never know which of these alerts are legitimate
and which ones are false positives.
Sometimes these false positives can
create significant problems.
For example, in April 2017, the Webroot anti-virus
began marking certain operating system files in Windows
as being malicious and it began quarantining parts
of the operating system itself.
It also marked Facebook and Bloomberg sites
as phishing sites even though the Windows files
and these sites were not malicious at all.
Perhaps, even worse than a false positive on an IPS
is a false negative.
This is when malicious traffic came through the IPS
but the IPS did not identify it as malicious.
If this malicious traffic did get through the firewall, then
you probably have a machine that has been infected
and you'll ultimately see that whenever
you perform an anti-virus scan.
But it sometimes can be difficult to know
when this happens because you got
no messages and no identification of anything
malicious, you have no idea that it passed through the IPS.
In some cases, you can find industry tests that
are done with intrusion prevention systems
and anti-virus and anti-malware where they will send traffic
through the software and hardware
to see what kind of catch rates they can get.
So that you at least have some way
to compare the differences between one IPS and another.