When you're trying to protect your network,
it's nice to have devices that can
watch all of the traffic that's going
in and out of your network.
In this video I'm going to give you
an overview on network intrusion detection
and network-based intrusion prevention devices.
When we're discussing network-based intrusion
detection or intrusion prevention,
we're talking about systems that we commonly call NIDS or NIPS.
It's common to hear these referred to as an IDS or an IPS
system where we just assume the network piece is
at the beginning of that.
These go beyond what you would find with a firewall.
An intrusion detection or intrusion prevention system
is designed to look into the data itself.
They could stop operating system exploits.
They can look at application vulnerabilities.
They can stop buffer overflows or identify
cross-site scripting.
These are designed to get into the details of what's going on
in the network communication, and allow or deny
based on particular rules.
Although the functionality is similar between an intrusion
detection system and an intrusion prevention system,
the ultimate goal is different.
And intrusion detection system can
identify these vulnerabilities and buffer
overflows and database injections that might
be coming through our network.
But it can only identify them and alarm
or alert you that's occurred.
An intrusion prevention system can not only
see that this particular vulnerability is passing
through the network, but it can actually
stop it before it traverses the network.
That's the difference between a detection and a prevention,
is that a detection can see it.
But a prevention can actually stop it.
As you can imagine, a device that's on your network
and looking at all the traffic going by
and only taking out the bad traffic,
has got to use a number of different techniques
to identify the good from the bad.
One of these techniques is a signature type
of technique, where the device is looking
for a very specific flow of traffic in a very specific data
stream.
And if it sees this very specific type of data going by,
it identifies that as a known signature,
and can then act on that information.
You're looking for a perfect match of data going by.
So this is a very precise and very specific signature.
Another type of identification technology
is one based on an anomaly.
These devices can watch what's normal over time.
And then if anything changes, it can then identify that change,
and then allow or block based on the rules you've
associated with something associated with that anomaly.
Another common way to identify this is based on a behavior.
If somebody is accessing a particular share
on the network, you may identify that particular behavior
as something bad and choose to allow or disallow
that communication.
And, perhaps, one of the more advanced functions
for identification would be heuristics,
where artificial intelligence is used to identify
something that might be bad.
There might not be a specific signature.
There might have never been something in the past
that we can compare this with.
But the intrusion prevention system
is designed to look for things that are very unusual.
And if it finds something unusual,
it will then stop it based on these heuristics.
There are a number of ways to implement an IDS or an IPS.
One of the easiest ways is through software.
There's open source software, like Snort,
that you can load onto a computer,
and have that perform the intrusion detection
capabilities.
Or even add multiple interface cards to the computer
and have intrusion prevention functionality as well.
There's also live CDs available so you can literally
download a Snort machine, install it onto your device,
and be up and running very, very quickly.
When you get into larger environments,
you need more speed.
And that speed comes in the form of hardware.
You would have these specialized appliances
that are designed to be intrusion detection
or intrusion prevention systems.
And they are usually designed around an enterprise.
Where there's high availability, you
could have multiple devices, you could
have them participate on the network
so that if you lose one intrusion prevention system,
the other one is able to take over.
And they can even send all of their logs and information
to a centralized syslog consolidation device.
We've also taken this network-based intrusion
prevention and brought it down to our desktop
through something we call host-based intrusion
prevention.
This is something that we used to run
as individual applications.
These days it's very common to see
it integrated into an anti-virus or an anti-spyware application
that's running right on your desktop.
These generally protect you based on signatures.
So you have to make sure that you're downloading and updating
these signatures so that the application knows
exactly what all the latest threats and vulnerabilities
might be.
But these can also protect you based on certain activities.
Since it's running on your desktop,
it can look to see what's happening in your operating
system.
And if certain files are being touched or changed,
it can tell you, and identify them,
and stop that particular function
from infecting your machine.