IDS and IPS devices function by performing traffic inspection to detect unauthorized traffic that tries to enter the enterprise network. Their main role is to monitor networks for intrusions or other malicious activity and they can come in multiple forms:
- Hardware appliances
- Software solutions
- Virtual solutions
The major difference between Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) is that IPS devices operate inline with the traffic, while IDS devices only receive a copy of the traffic so they can analyze it.
Based on their role in the network, IPS and IDS solutions can be categorized as follows:
- Behavior-based: works by monitoring traffic behavior and comparing it to traffic patterns defined as baseline
- Signature-based: works by inspecting packets for malicious signatures
- Network-based: monitors the entire network for suspicious traffic and analyzes protocol activity
- Host-based: software applications that protect servers or user machines by analyzing events occurring within that host
Sensor placement is a very important aspect, as IPS devices should be placed strategically throughout the organization, such as:
- Outside the firewall
- Inside the firewall
- On the same VLAN as the critical servers (DMZ or server farm)
Vulnerability scanning is the action of performing a series of non-intrusive tests on the network to detect possible security and privacy breaches within the infrastructure. Unlike a penetration test, which is often intrusive, a vulnerability test consists of a series of passive activities. These types should be part of the organization’s security policy and have a proactive nature. This means they should be performed before an attacker tries to access the network.
A honeypot is a security tool that allows you to attract possible attackers in an isolated environment, where they cannot do any harm to the network. Honeypots are controlled environments in which you can analyze the attackers’ behavior and gather information on the types of techniques they are using to get into the network. Honeypots can be grouped into honeynets.