Securing Your Network

Question 1

IDS

Answer 1

Intrusion Detection System

• Monitor network (protocol analyzer)
• send alerts when suspicious activity detected
• Out of band or passive - monitors traffic, but does not go through IDS
• IDS responds to attack AFTER it has started - alerts, modify ACLs, close offending process, divert attack to honeypot

Question 2

IPS

Answer 2

Intrusion Prevention System

• Monitor network (protocol analyzer)
• Detect, react, prevent attacks
• inline (inband) with traffic - all traffic passes through, IPS can block malicious traffic to prevent attackt

Question 3

HIDS

Answer 3

Host-Based Intrusion Detection System

• Software
• Monitors network traffic to host it’s installed on
• Monitors applications installed on host
• Protect local OS files
• May be installed on workstations in addition to antivirus - can detect malware antivirus would miss

Question 4

NIDS

-What can’t it do?

Answer 4

Network-Based Intrusion Detection System

• Monitors activity on network
• Sensors on routers and firewalls
• Report to monitoring server hosting NIDS console
• Cannot detect anomalies on individual workstations
• Cannot decrypt encrypted network traffic
• Can use tap or port mirror on switch/router as sensor - sends all switch traffic to single port

Question 5

HIPS

Answer 5

Host-Based Intrusion Prevention System

Question 6

NIPS

Answer 6

Network-Based Intrusion Prevention System

• NIPS more common than HIPS
• May use SSL decryptor to read encrypted traffic

Question 7

IEEE 802.1X

Answer 7

IEEE 802.1X

• Port-based authentication protocol
• Port security
• Wired or wireless
• Prevents rogue devices from connecting
• Usernames/passwords or certificates
• Can combine with VLAN: 802.1X server grants access to clients that authenticate; directs others to VLAN guest network
• Can be implemented as RADIUS or Diameter server - authenticate VPN clients before they connect
• supplicant SW runs on clients
• authenticator - network device that is acting as a “gatekeeper” to the network – typically a switch or Wireless LAN Controller (WLC). It prevents access to the network (if configured to do so) until the authentication server tells it otherwise. The authenticator is responsible for taking the messages from the supplicant, encapsulating them in RADIUS and sending them to the authentication server for processing
• authentication server - decides if clients can access NW

-EAP conversation takes place between the supplicant and the authentication server, with the authenticator just acting as a middle man and tunnelling the messages in RADIUS.