Intrusion Prevention - CompTIA Security+ SY0-701 - 3.2

Intrusion Prevention Systems Explained

Overview of Intrusion Prevention Systems (IPS)

• An Intrusion Prevention System (IPS) monitors network traffic in real-time to identify and block potential threats or exploits.

• IPS can detect known vulnerabilities, such as operating system exploits or application vulnerabilities, as well as generic issues like buffer overflows and SQL injections.

Comparison with Intrusion Detection Systems (IDS)

• Unlike an Intrusion Detection System (IDS), which only alerts about vulnerabilities without blocking them, an IPS actively prevents harmful traffic from entering the network.

• The primary function of an IPS is to ensure that malicious data does not compromise network security by blocking it immediately upon detection.

Fail-Safe Mechanisms in Security Devices

• Security devices like IPS can fail due to power loss, hardware issues, or software bugs; their configuration determines how they handle failures.

• Fail-open: If the device fails, traffic continues flowing but without security checks. This keeps the network operational but unprotected.

• Fail-closed: A failure results in severed connections and no communication through that link, which may be undesirable for most networks.

Inline vs Passive Monitoring Configurations

Inline Configuration

• In an inline setup, the IPS is placed between a firewall and a core switch to actively monitor all incoming traffic for legitimacy before allowing it through.

• Active monitoring is often preferred because it allows immediate identification and blocking of potential attacks before they reach critical parts of the network.

Passive Monitoring

• Organizations may opt for passive monitoring if they are concerned about potential downtime caused by active systems or overly aggressive blocking of legitimate traffic. In this case:

• Traffic flows normally while a copy is sent to the IPS for analysis without interrupting communication between devices on the switch.

• This method limits the ability of the IPS to block threats in real-time since it's not inline with regular communications; thus it's often referred to as IDS design despite using an IPS technology.

Traffic Evaluation Process

• During active monitoring:

• Traffic passes through a firewall and then through the IPS where it’s evaluated.

• Legitimate traffic proceeds to the core switch while potentially malicious traffic gets blocked immediately by the IPS.

Passive Monitoring Techniques

• For passive monitoring setups:

• Methods such as port mirroring (SPAN) or physical network taps are used to duplicate traffic for analysis without affecting normal operations.