CYS406 · Annotated SlidesChapter 12 — Intrusion Detection and Prevention Systems
Chapter 12 · Annotated slides

Intrusion Detection and Prevention Systems

How an IDS works and what it can and can’t do, indications of intrusion, IDS classifications (signature vs. anomaly, active vs. passive, network vs. host), IDS components, deployment, alert types (true/false positives and negatives), choosing an IDS/IPS, and Snort.

Slide text Study notes Highlight: key words Tips, tricks & traps Seen again elsewhere How it can come up
Slide 1: Module Flow
Exam weight Low
    Slide 2: Intrusion Detection and Prevention System (IDS/IPS)
    Exam weight High
    1. IDS detects and alerts (passive, out of band); IPS sits inline and can block.
    🎯 How this can come up · 1 question
    MCQ

    The key difference between an IDS and an IPS is that an IPS:

    Slide 3: How does an IDS Work?
    Exam weight Low
      Slide 4: Role of an IDS in Network Defense
      Exam weight Low
        Slide 5: How an IDS Detects an Intrusion?
        Exam weight Low
          Slide 6: IDS Capabilities
          Exam weight Low
            Slide 7: IDS/IPS Limitations: What an IDS/IPS is NOT?
            Exam weight Low
              Slide 8: IDS/IPS Security Concerns
              Exam weight Low
                Slide 9: General Indications of Intrusions
                Exam weight Low
                  Slide 10: IDS Classification
                  Exam weight Low
                    Slide 11: Approach-based IDS
                    Exam weight Low
                    1. Signature (misuse) detection: matches known attack patterns. Low false positives; misses new (zero-day) attacks.
                    Slide 12: Slide 12
                    Exam weight Low
                      Slide 13: Approach- based IDS (Cont’d)
                      Exam weight High
                      1. Anomaly detection: learns normal behaviour and flags deviations. Can catch new attacks; more false positives.
                      Memory trickSignature = known bad. Anomaly = not normal.
                      🎯 How this can come up · 1 question
                      MCQ

                      Which IDS approach can detect zero-day attacks?

                      Slide 14: Anomaly and Misuse Detection Systems
                      Exam weight Low
                        Slide 15: ❑ how it reacts to a potential intrusion
                        Exam weight Low
                          Slide 16: Protection-based IDS
                          Exam weight Low
                            Slide 17: An IDS is also classified as a centralized IDS or a distributed IDS , this classification is based on the structure of the IDS
                            Exam weight High
                            1. NIDS monitors network traffic (sensors on segments); HIDS monitors one host (logs, files, system calls).
                            🎯 How this can come up · 1 question
                            MCQ

                            An IDS that monitors a server’s system files and logs is:

                            Slide 18: Structure- based IDS (Cont’d)
                            Exam weight Low
                              Slide 19: Slide 19
                              Exam weight Low
                                Slide 20: Slide 20
                                Exam weight Low
                                  Slide 21: IDS Components
                                  Exam weight Low
                                  1. Components: network sensors, command console, alert system, response system, attack-signature database.
                                  Slide 22: Network Sensors
                                  Exam weight Low
                                    Slide 23: Command Console
                                    Exam weight Low
                                      Slide 24: Alert Systems
                                      Exam weight Low
                                        Slide 25: Response System
                                        Exam weight Low
                                          Slide 26: Attack Signature Database
                                          Exam weight Low
                                            Slide 27: Collaboration of IDS Components in Intrusion Detection
                                            Exam weight Low
                                              Slide 28: Slide 28
                                              Exam weight Low
                                                Slide 29: Staged IDS Deployment
                                                Exam weight Low
                                                  Slide 30: Deploying Network-based IDS
                                                  Exam weight Low
                                                    Slide 31: Deploying Network-based IDS (Cont’d)
                                                    Exam weight Low
                                                      Slide 32: Deploying Network- based IDS (Cont’d)
                                                      Exam weight Low
                                                        Slide 33: Deploying Network- based IDS (Cont’d)
                                                        Exam weight Low
                                                          Slide 34: Deploying a Host-based IDS
                                                          Exam weight Low
                                                            Slide 35: What is an IDS Alert?
                                                            Exam weight Low
                                                              Slide 36: Slide 36
                                                              Exam weight High
                                                              1. True positive: real attack, alert. False positive: no attack, alert. False negative: real attack, NO alert (the most dangerous). True negative: no attack, no alert.
                                                              🎯 How this can come up · 1 question
                                                              MCQ

                                                              An IDS missing a real attack is a:

                                                              Slide 37: Characteristics of Good IDS Solutions
                                                              Exam weight Low
                                                                Slide 38: Selection of an Appropriate IDS/IPS Solutions
                                                                Exam weight Low
                                                                  Slide 39: Intrusion Detection with Snort
                                                                  Exam weight Low
                                                                  1. Snort: open-source NIDS/IPS; rules: action protocol src_ip src_port -> dst_ip dst_port (options).
                                                                  Slide 40: Intrusion Detection Tools
                                                                  Exam weight Low