Understanding IDS and IPS for Network Security

Enhance the security of your network with IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) by monitoring traffic, inspecting data packets, and detecting malicious activities based on known signatures. Learn about different types like HIDS and NIDS, their functions, and tools used in practice to safeguard your network. Follow hands-on instructions for setting up Snort as an IDS on Windows.

• Network Security
• IDS
• IPS
• Intrusion Detection
• Intrusion Prevention

brec932 Follow

Uploaded on Sep 23, 2024 | 0 Views

Download Presentation

Please find below an Image/Link to download the presentation.

The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.

Presentation Transcript

1. NETWORK SECURITY LAB Lab 9. IDS and IPS

2. Introduction IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) increase the security level of network by: Monitoring traffic Inspecting and scanning data packets Inspection and detection is mainly based on the malicious signatures already recognized Flavors of IDS/IPS: Software and Hardware NIDS (Network IDS) HIDS (Host IDS)

3. HIDS and NIDS HIDS: Any antivirus can be considered as a HIDS as it will alert the user the moment a suspicious file or activity is detected. Hosted on the device per-se Reports malicious activities immediately to the user. NIDS: Strategically placed in the network. All network devices such as servers, routers, access points and client computers can be inspected for any malicious activity. Performs regular network traffic analysis Can store information in Security Information and Event Management System (SIEM) Alerts the system admin on unusual activities at both inspection and network traffic routines

4. NIDS Network Activity Monitoring NIDS: - Benchmarks & Rules can be configured

5. HIDS HIDS: - - - Placed on a single host and not for network Keeps checkpoints for comparison Scans files, file system, logs and software and alerts for the changes as malicious activity

6. Tools in practice - Industry is inundated with tools for IDS/IPS: - Snort - IBM Qradar (SIEM) - NG Secure Federated ID - FireEye MVX-IPS - McAfee Security Platform - NSFocus IPS - Secure works iSensor Intrusion Protection system

7. Hands on - Follow the Instruction document in the folder Lab 9 IDS and IPS for the hands on: - Setting up Snort as IDS on Windows