Sites:
Home > Technical Library > Networking and Communication Equipment > Chapter 1: Intrusion Prevention and Active Response

Chapter 1: Intrusion Prevention and Active Response

By et al.
From Intrusion Prevention and Active Response: Deploying Network and Host IPS

Introduction

The best way to prevent intrusion is to never deploy vulnerable software. Unfortunately, this goal is not achievable because of the scores of new vulnerabilities being announced every day in all sorts of software, but their comparatively more powerful counterparts in the world of intrusion prevention have not enjoyed nearly as widespread deployment.

Intrusion detection systems (IDS) are very useful as an indispensable part of a security administrator s toolset, but their comparatively more powerful counterparts in the world of intrusion prevention have not enjoyed nearly as widespread deployment.

If there is one constant in the world of intrusion detection and by extension intrusion prevention, it is the need for constant tuning, reviewing, and monitoring to ensure proper operation.

After a software vulnerability is announced, there may be significant lag time between the announcement and the availability of a patch to fix the problem. In the meantime, how can security be maintained? An IPS allows for granular decisions to be made about the types of interactions allowed to take place on a host or network, and in the case of vulnerable software that must remain accessible, may provide one of the only means to enhance security. For example, an application layer attack (such as a buffer overflow) against a Web server will be allowed through by a stateful firewall that does not process Application-layer data. A network IPS can block packets and/or sessions that contain such malicious Application-layer content.

This chapter outlines the general capabilities of active response systems and...

Copyright Syngress Publishing, Inc. 2005 under license agreement with Books24x7
Products & Services
Network Security Services
Network security services determine vulnerability of networks to outside intruders, as well as maintain anti-viral and firewall updates and usage.
Network Appliances
Network appliances are inexpensive personal computers (PC) or computer boards that provide Internet access and promote network security. They lack many of the features of fully-equipped PCs, however.
Network Security Software
Network security software includes everything from remote access protection to firewall and security appliance solutions to email security to web filtering, monitoring, bandwidth protection, and all elements of computer network security/computer security.
Network Firewalls
Network firewalls protect computer networks against unauthorized use or attack. They permit or deny access to private network devices and applications, and represent an important part of an organization's overall security policy. Firewalls may be software applications, hardware devices (such as routers), or a combination of both. They include turnkey products that are relatively easy to install as well as complex, multi-layer installations that require the expertise of a certified network administrator. 
Protocol Stack Software
Protocol stack software is a set of hierarchical network protocols that manage the flow of data in communication systems. Each protocol in the stack or suite supports the protocol above it and uses the one below it. TCP/IP is an example of a stack.
Topics of Interest

Introduction Network devices have been inspecting packets for as long as packets have existed. Traditionally, routers and firewalls look at headers and protocol information to make forwarding...

Introduction Host integrity monitoring intersects many areas of security, including intrusion detection, change management, security administration, and intrusion prevention. To effectively monitor...

Introduction This chapter explores the concept and implementation of inline Application-layer data modification, and provides several motivating examples for why this technique provides an effective...

Introduction This chapter discusses a pervasive two-pronged problem that plagues nearly all intrusion detection systems (IDS ) false positives and false negatives and shows that this problem can...

Introduction Intrusion prevention systems (IPS ) combine the best features of a firewall and an Intrusion Detection System (IDS) not only to detect attacks, but also to prevent them. One important...