2 - IDS

Question 1

IDS

Answer 1

Intrusion Detection Systems

Question 2

Define an intrusion

Answer 2

Set of actions aimed to compromise security

Question 3

Activity is suspicious (IDS) if

Answer 3

1. Matches a pattern for known malicious activity
2. Differs significantly from previous patterns of use.

Question 4

IDS Components

Answer 4

Audit Data Preprocessor
Detection Engine (+Models)
Decision Engine (+Table)

Question 5

IDS Functions

Answer 5

1. Monitor activity
2. Audit Sys config
3. Assess system integrity
4. Recognise known attacks
5. Indentify abnormal activity
6. Manage audit trails
7. Correct config errors
8. Install/open traps to record info

Question 6

IDS Types

Answer 6

• Network (links/backbones)
• Host (OS)
• Distributed (group of remote sensor IDSes)
• Gateway (deployed at gateway)

Question 7

IDS responses

Answer 7

Alarm
Cut user access
Reject traffic
…

Question 8

IDS Problems

Answer 8

• Inaccuracy for exploit based signatures
• Cannot recognise unknown intrusions
• Cannot provide quality forensics info

Question 9

IDS before or after firewall

Answer 9

Before can be very slow but after might be quicker.

Before might be required to protect firewall