TABLE OF CONTENTS In this chapter, we take a sharp detour away from the discussion of passive rule-based intrusion detection with the Snort intrusion detection system (IDS) and instead start down the path where we take reactive measures in response to attacks. When used judiciously, these automated response measures can prevent some attacks from successfully compromising the security of a system or network. This applies in particular to self-propagating attacks (such as those that are launched by a worm) as opposed to attacks by savvy individuals who go to great lengths to avoid detection in the first place. Remember; active response mechanisms can be effective only against attacks that have actually been detected. Active response is defined as the dynamic reconfiguration or alteration of network access control mechanisms, sessions, or even individual packets based on alerts that an IDS generates.
If you are reading this chapter, chances are good that you have heard the term intrusion prevention in the context of network security. When referring to network-based security techniques, the term network intrusion prevention is usually applied to an inline device (such as an Ethernet bridge or firewall) that has the capability of modifying or discarding individual attack packets as they attempt to traverse the devices interfaces. Unfortunately, marketing and sales teams have redefined and abused this term to the point that many security professionals have a completely reasonable allergic reaction when hearing it and refuse to have anything to do with it. This is a...
