IDS and IPS devices function by performing traffic inspection to detect unauthorized traffic that tries to enter the enterprise network. Their main role is to monitor networks for intrusions or other malicious activity and they can come in multiple forms:
- Hardware appliances
- Software solutions
- Virtual solutions
The major difference between Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) is that IPS devices operate inline with the traffic, while IDS devices only receive a copy of the traffic so they can analyze it.
Based on their role in the network, IPS and IDS solutions can be categorized as follows:
- Behavior-based: works by monitoring traffic behavior and comparing it to traffic patterns defined as baseline
- Signature-based: works by inspecting packets for malicious signatures
- Network-based: monitors the entire network for suspicious traffic and analyzes protocol activity
- Host-based: software applications that protect servers or user machines by analyzing events occurring within that host
Intrusion detection, even though it is an old technology, is still used because there are still places where you do not want to have a sensor running inline with the traffic. Having a promiscuous mode (an IDS) device that captures and analyzes traffic, for example in the DMZ, is still a valid approach in modern networks and the underlying security policy will be the same, whether you are deploying IDS or IPS.
The actions taken by a device in a promiscuous mode include sending alerts, alarms, log messages, or SNMP traps. On the other hand, when you add an inline sensor, the device will take more aggressive actions, like dropping packets or blocking the source IP address.
Sensor placement is a very important aspect, as IPS devices should be placed strategically throughout the organization, such as:
- Outside the firewall
- Inside the firewall
- On the same VLAN as the critical servers (DMZ or server farm)
A very important IPS/IDS placement issue is considering the effect your design will have on the network traffic. Promiscuous mode (IDS) will not have any effect on the traffic because you are basically using SPAN (port mirroring) to send copies of traffic over a trunk port to a sensor. However, when deploying IPS solutions, it is very important for the device to be able to process all the traffic that flows on that particular segment, because all the traffic passes through the IPS device.
Figure 32.1 – IPS Deployment Models
When placing the IPS sensor on the enterprise network, there are several options to choose from, as depicted in Figure 32.1 above:
- Two Layer 2 devices (without trunking): This is a popular campus design, where the sensor is placed between two Layer 2 devices (a Layer 2 switch and a transparent mode firewall). The IPS can be between the same VLAN on two different switches or it can be between VLANs with the same subnet on two different switches.
- Two Layer 2 devices (with trunking): This is similar to the previous model, with the difference of having a trunk between the two devices. This is a common scenario that provides protection for several VLANs from a single location, with the sensor being placed on a trunk port between switches. The sensor can protect a pair or a larger group of VLANs.
- Two Layer 3 devices: This design model involves placing the sensor between a Layer 3 switch or a router and a firewall that is running in routed mode (two Layer 3 devices in the same subnet). This deployment option is common in the Server Farm module, the Enterprise Campus module, and the E-commerce module. This is much easier to configure since the integration takes place without actually having to touch any of the other devices, unless the IPS module is integrated in another device.
- Two VLANs on the same switch: This model involves sensor bridging VLANs together on the same switch by bringing packets in on one VLAN and sending them out on another VLAN. This is a common scenario with some appliances.
Some of the challenges of deploying IDS and IPS include the following:
- Asymmetric traffic flows: Usually, the network packet flows are symmetric, meaning they take the same path through the network in both directions (from the source to the destination and from the destination to the source). However, a lot of newer network designs do not have symmetrical traffic flows, as they are engineered to take advantage of all the links in the network, especially the low-cost ones. Asymmetric traffic flows exist if you want voice traffic to follow a different path than the data traffic path and this is a common issue with the emergence of any-to-any traffic and VoIP services. This problem should be carefully managed and network designers should be aware of traffic patterns that can influence IPS sensor deployment.
- High availability issues: Problems might occur if inline placed sensors go down, especially when they are configured in a failed close deployment type, meaning any hardware failure will block all the traffic. The IPS device must be carefully placed in the network and configured with high availability in mind (active/active or active/standby) to avoid major service outages on the network.
- Choosing an appropriate IPS device: You can use a wide variety of IPS appliances with different features and port densities. Special care must be taken when virtualizing the IPS service because this adds more complexity, as virtual sensors have different features that depend on platform and licensing models.
- Choosing the appropriate management and monitoring solution: Complex IPS deployments need robust management and monitoring solutions that can integrate with the respective appliances.
- Regularly updating IPS signatures: Something that sets IPS sensors apart from other security devices (like firewalls) is that signatures have to be updated on a regular basis. It is critical for the network operations team to ensure that new signature definitions are regularly downloaded and installed on the IPS device to keep up with evolving threats and vulnerabilities.