Intrusion Detection and Prevention Systems (IDS/IPS): Computer Security Lectures 2014/15 S1

The slides themselves are creative commons licensed CC-BY-SA, and images used are licensed as individually attributed.

Topics covered in this lecture include:
Intrusion Detection and Prevention Systems
Detection
Test Your Awareness: Do The Test
Terminology: True positive, False positive, True negative, False negative
Intrusion Detection Systems
Network-based IDS
Host-based IDS monitors system activity
Intrusion Prevention Systems
Intrusion detection and prevention system (IDPS)
Network design
Signature-based detection
String or pattern matching
Anomaly-based detection
Statistical anomaly: activity differs from the baseline (heuristics of what normally happens on your network)
Protocol anomaly: traffic that does not conform to the protocol specifications (for example, something on port 80 that is not HTTP)
There are various ways that attacks can avoid being detected by an IDS
Anomaly-based: normal changes in activity can cause false positives
Signature-based: must be kept up-to-date
Encryption, alternative encoding, and so on
Packet fragmentation
Limitations
Snort
Simple signature-based rule language
Rules are prioritised based on complexity
Snort rules
Actions, Protocols, Directions, Pattern matching options, content
Alerts and logging
Snort commands
Snort rule sets
Other Snort tools
Monitoring Snort: ACARM-ng, Snortsnarf, SnortALog, Snort_stat, ACID
Responding
Other IDS
Bro, Suricata
Other IDS vendors
Recommended reading

[zofe]

DMZ needs be sandwiched between an external Firewall - configured for safety e.g. against D/DOS attacks,
and between an internal one - configured for security e.g. restricted to authenticated and authorized services.

[winstonchurchill]

+Z. Cliffe Schreuders
Why are you putting all these vulnerabilities into software?
Is that some kind of marketing trick?

[ajnui]

when you talk port 80 - http, does that include https?

[ginomesiasselada]

amigos buen video podrian subir mas videos de ids o seguridad y lo de site to site redes configuracion de equipos fortinet checkpoint etc sube videos en espa;ol

[ITsupportian]

True Positive -   You nice gf is able to come in to your house
True Negative -   Your Mean ex gf is stopped in front at your gate and cannot come in.
False Negative - Your Mean ex-gf got inside your house and life and manipulating you.
False Positive - Your nice gf is stopped in front your house, your brother thought she was your mean ex-gf.


Anything that is starts with a TRUE is good.
Anything that is starts with a FALSE is  bad

Anything that is non-offensive(nice gf)  is positive.
Anything that is offensive(mean ex) is negative.