Security Operations

IDS: passive, out-of-band, low impact

IPS: active, in-line, impact on network performance

5

IDS and IPS technologies are both deployed as sensors. An IDS or IPS sensor can be in the form of several different devices:

A router configured with Cisco IOS IPS software

A device specifically designed to provide dedicated IDS or IPS services

A network module installed in an adaptive security appliance (ASA), switch, or router

IDS and IPS technologies use signatures to detect patterns in network traffic. A signature is a set of rules that an IDS or IPS uses to detect malicious activity. Signatures can be used to detect severe breaches of security, to detect common network attacks, and to gather information. IDS and IPS technologies can detect atomic signature patterns (single-packet) or composite signature patterns (multi-packet).

Types of IDS

6

Host-based IDS (HIDS) - examine specific host-based actions, such as what applications are being used, what files are being accessed and what information resides in the kernel logs.

Network-based IDS (NIDS) - analyze the flow of information between computers, i.e., network traffic.

https://www.techwalla.com/articles/description-of-the-difference-between-hids-nids

Types of IPS

7

Host-based IPS (HIPS) - software installed on a host to monitor and analyze suspicious activity. (evaluate packets before they're allowed to enter a computer)

Network-based IPS (NIPS) - can be implemented using a dedicated or non-dedicated IPS device.  Sensors detect malicious and unauthorized activity in real time and can take action when required. (evaluate traffic before it's allowed into a network or subnet)

Signature Alarms

8

Ten Strategies of a World-Class Cybersecurity Operations Center: page 121 – 122

Table 9. Advantages and Disadvantages of Intrusion Detection Elements

Read more information about IPS/IDS at

9

Tutorial – tripwire (file integrity monitoring)

10

https://github.com/Tripwire/tripwire-open-source

Install: apt install tripwire

Generate keys:

./twadmin --generate-keys -L /etc/tripwire/${HOSTNAME}-local.key

./twadmin --generate-keys -S /etc/tripwire/site.key

(Edit the policy configuration file: gedit twpol.txt)

Generate the policy: sudo twadmin --create-polfile -S site.key twpol.txt

Create the baseline: tripwire --init

Finally the check: tripwire –check

Report: twprint --print-report --twrfile /var/lib/tripwire/report/kali-20210414-110547.twr

sudo apt-get update (if needed)

Open Source Tripwire® is a security and data integrity tool for monitoring and alerting on file & directory changes.

https://www.techrepublic.com/article/how-to-install-and-use-tripwire-to-detect-modified-files-on-ubuntu-server/

Network Monitoring

11

Active – Proactively detect network and application issues; sending real traffic across a network (ping, traceroute)

Passive – Identify top protocols and users; listen only

SNMP – device-level monitoring Simple Network Management Protocol for collecting and organizing information about managed devices (e.g., routers, switches, servers, workstations, printers)