Explaining Intrusion

Prevention

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-1

Intrusion Detection
Versus Intrusion
Prevention

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-2

IDS vs IPS
An intrusion detection system has the
capability to detect misuse and abuse of, and
unauthorized access to, networked
resources.
An intrusion prevention system has the
capability to detect and prevent misuse and
abuse of, and unauthorized access to,
networked resources.

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-3

Intrusion Prevention Systems

An intrusion prevention system has the
capability to detect and prevent misuse and
abuse of, and unauthorized access to,
networked resources.

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-4

Intrusion Detection
Technologies

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-5

Profile-Based Intrusion Detection

Is also known as anomaly detection because
activity detected deviates from the profile of
normal activity
Requires creation of statistical user and network
profiles
Is prone to high number of false positives; difficult
to define normal activity

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-6

Signature-Based Intrusion Detection

Is also known as misuse detection or pattern
matching; matches pattern of malicious activity
Requires creation of signatures
Is less prone to false positives; based on the
signatures ability to match malicious activity

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-7

Protocol Analysis
Intrusion detection analysis is performed on
the protocol specified in the data stream.
Examines the protocol to determine the validity of
the packet
Checks the content of the payload (pattern
matching)

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-8

Intrusion Detection
Evasive Technique

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-9

Evasive Techniques
Attempts to elude intrusion prevention and
detection use evasive techniques such as the
following:
Flooding
Fragmentation
Encryption

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-10

Flooding

Saturating the network with noise traffic

while also trying to launch an attack against
the target is referred to as flooding.

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-11

Fragmentation

Splitting malicious packets into smaller

packets to avoid detection and prevention is
known as fragmentation.

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-12

Encryption

SSL Session

Launching an attack via an encrypted session can

avoid network-based intrusion detection and
prevention.
This type of evasive technique assumes that the
attacker has already established a secure session
with the target network or host.
2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-13

Cisco Network Sensors

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-14

Cisco Sensor Family

Performance (Mbps)

600

250

IDSM-2
IDS 4255

200

IPS 4240

80

AIP-SSM

45

NM-CIDS
10/100/1000 TX

IPS 4215
10/100 TX

10/100/1000 TX

10/100/1000 TX
1000 SX

10/100/1000 TX

Switched/1000

Network Media
2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-15

Sensor Appliances

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-16

Sensor Appliance Interfaces

Untrusted
Network

Monitoring Interface
Router

Switch

Sensor

Router

Protected
Network
Command and
Control Interface

Management System
2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-17

Cisco 4215 Sensor Front Panel

Monitoring
Network
Interface
Card LED

Power LED

2005 Cisco Systems, Inc. All rights reserved.

Command and
Control Network
Interface Card
LED

IPS v5.02-18

Cisco 4215 Sensor Back Panel

Optional
Monitoring
Interfaces

Console
Port

Monitoring
Interface

2005 Cisco Systems, Inc. All rights reserved.

Command
and Control
Interface

IPS v5.02-19

Cisco 4240 Sensor Front Panel

Power
Indicator

2005 Cisco Systems, Inc. All rights reserved.

Status
Indicator

Flash
Indicator

IPS v5.02-20

Cisco 4240 Sensor Back Panel

Command and
Control
Interface

Expansion Slot

Monitoring
Interfaces

Power
Connector

Indicators

Auxiliary
Port

USB
Ports
Power
Indicator

2005 Cisco Systems, Inc. All rights reserved.

Compact
Flash

Status
Indicator

Console
Port

Flash
Indicator

Indicator
Light
Power
Switch
IPS v5.02-21

Cisco 4255 Sensor Front Panel

Power
Indicator

2005 Cisco Systems, Inc. All rights reserved.

Status
Indicator

Flash
Indicator

IPS v5.02-22

Cisco 4255 Sensor Back Panel

Command
and Control
Interface

Monitoring
Interfaces

USB
Ports
Status
Indicator
2005 Cisco Systems, Inc. All rights reserved.

Console
Port

Indicators

Power
Indicator

Expansion Slot

Compact
Flash

Power
Connector
Auxiliary
Port
Flash
Indicator

Indicator
Light
Power
Switch
IPS v5.02-23

Promiscuous-Mode IDS
and Inline-Mode IPS

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-24

Promiscuous-Mode Protection: IDS

1
A network device sends copies
of packets to the sensor for analysis.

2
If the traffic matches a signature,
the signature fires.
Switch

32
The sensor can send an alarm
to a management console and
take a response action such as
resetting the connection.

Sensor

Management
System
2005 Cisco Systems, Inc. All rights reserved.

Target

IPS v5.02-25

Inline-Mode Protection: IPS

The sensor resides in the

data forwarding path.

Sensor

An alert can be
sent to the
management console.

Management
System
2005 Cisco Systems, Inc. All rights reserved.

If a packet triggers a
signature, it can be
dropped before it
reaches its target.

Target

IPS v5.02-26

Reliable IPS
IPS software contains several features that
enable you to use inline deny actions with
confidence. Among these features are the
following:
Risk rating
Software bypass mode
Application firewall
Meta event generator

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-27

Cisco Defense in Depth

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-28

Network IPS
Sensors are connected to network segments. A
single sensor can monitor many hosts.
Growth of a network is easily protected. New hosts
and devices can be added to the network without
additional sensors.
The sensors are network appliances tuned for
intrusion detection analysis.
The operating system is hardened.
The hardware is dedicated to intrusion detection
analysis.

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-29

Network IPS (Cont.)

Corporate
Network

Firewall

Switch

Switch

Router

Untrusted
Network
Sensor

Management
Server

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-30

Host Intrusion Prevention System

Consists of agent software installed on each host
Provides individual host detection and protection

Does not require special hardware

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-31

Host Intrusion Prevention System (Cont.)

Corporate
Network

Agent
Agent

Application
Server
Firewall

Untrusted
Network
Agent

Agent

Agent

Agent

SMTP
Server

2005 Cisco Systems, Inc. All rights reserved.

Agent

Console

Agent

Agent

WWW DNS
Server Server

IPS v5.02-32

Defense in Depth: A Layer Solution

Application-level encryption
protection

Host-Focused
Technology

Policy enforcement (resource

control)

Web application protection

Buffer overflow
Network attack and
reconnaissance detection
DoS detection
Network-Focused
Technology
2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-33

Sensor Deployment

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-34

Sensor Selection Factors

Network media: Ethernet, Fast Ethernet, or Gigabit
Ethernet
Intrusion detection analysis performance: bits per
second
Network environment: T1/E1, switched, multiple
T3/E3, or gigabit

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-35

Deploying IDS and IPS

Branch
Corporate
Network
NM-CIDS

Router Firewall

Untrusted
Network

Sensor

IDSM2

Management
Server

Sensor

CSA Agent

WWW
Server
2005 Cisco Systems, Inc. All rights reserved.

CSA Agent

DNS
Server
IPS v5.02-36

IDS and IPS Sensor Placement

Inside
Attacker

Internet

Sensor on Outside:

Sensor on Inside:

Sees all traffic destined

for your network

Sees only traffic

permitted by firewall

Has high probability of

false positives

Has lower probability of

false positives

Does not detect internal

attacks

Requires immediate
response to alarms

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-37

IPS Terminology

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-38

Vulnerabilities and Exploits

A vulnerability is a weakness that compromises
either the security or the functionality of a system.
Poor passwords
Improper input handling
Insecure communications
An exploit is the mechanism used to leverage a
vulnerability.
Password guessing tools
Shell scripts
Executable code
2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-39

False Alarms
False positive: Normal traffic or a benign action
causes the signature to fire.
False negative: A signature is not fired when
offending traffic is detected. An actual attack is not
detected.

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-40

True Alarms
True positive: A signature is fired properly when
the offending traffic is detected. An attack is
detected as expected.
True negative: A signature is not fired when
nonoffending traffic is detected. Normal traffic or a
benign action does not cause an alarm.

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-41

Cisco IPS Software

Architecture

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-42

Software Architecture Overview

These are the primary components of the IPS
software architecture:
Event Store provides storage for all events.
Analysis Engine is the monitoring application.
MainApp is the core application.

Web server runs within mainApp and services all

web and SSL requirements.
SSH and Telnet services SSH and Telnet
requirements for the CLI application.

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-43

Software Architecture Overview (Cont.)

IDAPI provides the communication channel
between applications.
Network Access Controller runs within mainApp
and is used to initiate the blocking response action
on network devices.
NotificationApp supports SNMP gets.

Sensor interfaces serve as the traffic inspection

points. Sensor interfaces are also used for TCP
resets and IP logging.

2005 Cisco Systems, Inc. All rights reserved.

IPS v5.02-44