Tài liệu Intrusion Detection and Prevention ppt

Intrusion Detection and Prevention Because network traffic must cross the firewall to reach the end systems, the firewall has also become a point where the inspection of this traffic is

Intrusion Detection and Prevention

Because network traffic must cross the firewall to reach the end systems, the firewall has also become a point where the inspection of this traffic is appropriate For many years, firewall vendors such as Cisco Systems, Inc and Check Point have been including

intrusion detection system (IDS) capabilities to their firewalls These devices were the first "in-line" IDS systems long before in-line IDS-dedicated appliances ever existed

Overview of IDS

Intrusion detection is an aspect of security whereby a device detects the fingerprint of an attack within the network Modern IDSs use a variety of techniques to ensure that the alarms they raise are of actual attacks being conducted rather than a false alarm Many IDSs connect to the network through a port on a switch, and the interface that connects to that port captures traffic to a particular system or subnet, as shown in Figure 14-2

Figure 14-2 Intrusion Detection

[View full size image]

The Firewall as an IDS Sensor

As firewall hardware has become more and more powerful, vendors have sought to use the additional computing power by adding features to the firewall code Many vendors have offered IDS capabilities in their firewalls for quite some time and have made the firewalls the first true in-line intrusion prevention systems (IPSs) However, the IDS code

in the firewall was, until recently, not on par with the IDS code used in the dedicated IDS appliance For example, the Cisco PIX Firewall integrated IDS capability was really an incredibly small subset of the capabilities of their dedicated IDS/IPS offerings The IDS capabilities of the firewall did not fully mimic those of the dedicated appliance because

of concerns about the impact of those capabilities on firewall performance However, the firewall does make an excellent sensor in that it is directly in-line with the traffic flow and has the capability to capture all traffic destined for target hosts located behind the firewall

Combined with other IDS devices, such as dedicated appliances, the firewall makes an effective line of defense with these capabilities In addition to the use of dedicated IDS appliances, the use of host IPS agents helps significantly improve the deterrent

capabilities and the defenses of a network With alarms from firewalls, dedicated IDS appliances, and host IPS agents, a strong correlation can be made in identifying a real attack versus a false positive This, in turn, can allow the administrator to better conduct countermeasures such as having the dedicated appliance issue TCP resets or use shunning

or even allow the firewall to drop the offending traffic Overall, the role of firewalls in intrusion detection is still being defined as vendors migrate more and more IDS code into the firewall appliance

The Firewall as the IPS

With the increased market desire to go beyond simple intrusion detection to intrusion prevention, more vendors have begun using the firewall not just as an IDS sensor but as

an actual IPS device in and of itself (particularly true of devices such as the Cisco

Adaptive Security Appliance [ASA])

The logic behind this is relatively sound Because the firewall is a natural control point for network traffic, and because all traffic entering or exiting a network through a firewall must be processed by the firewall anyway, with added IPS functionality the firewall can not only detect intrusion attempts on its own, it can also then block the traffic without requiring any other devices to be involved in the processing decision This functionality

is relatively new and is largely the result of the increased processing power of today's microprocessors, which allow a firewall to perform this more intensive data processing with a minimal impact on network performance