Page 477 - StudyBook.pdf

Topologies and IDS • Chapter 7 461

automating a response and moving these systems from detection to prevention they
actually have the ability to block incoming traffic from one or more addresses from
which an attack originates.This allows the IPS the ability to halt an attack in pro-
cess and block future attacks from the same address.

EXAM WARNING
To eliminate confusion on the Security+ exam about the differences
between and IDS and an IPS, remember that an IPS is designed to be a
preventive control. When an IDS identifies patterns that may indicate
suspicious activities or attacks, an IPS can take immediate action that
can block traffic, blacklist an IP address, or even segment an infected
host to a separate VLAN that can only access an antivirus server.

Popular Commercial IDS Systems

Literally hundreds of vendors offer various forms of commercial IDS implementa-
tions.The most effective solutions combine network- and host-based IDS imple-
mentations. Likewise, most such implementations are primarily signature-based,
with only limited anomaly based detection capabilities present in certain specific
products or solutions. Finally, most modern IDSes include some limited automatic
response capabilities, but these usually concentrate on automated traffic filtering,
blocking, or disconnects as a last resort.Although some systems claim to be able to
launch counterstrikes against attacks, best practices indicate that automated identifi-
cation and backtrace facilities are the most useful aspects that such facilities provide
and are therefore those most likely to be used.

Weighing IDS Options
Head of the Class… work administrators identify more potential suppliers than they would
In addition to the various IDS and IPS vendors mentioned in the pre-
ceding list, judicious use of a good Internet search engine can help net-

ever have the time or inclination to investigate in detail. That is why we
also urge administrators to consider an alternative: deferring some or all
of the organization’s network security technology decisions to a special
type of outsourcing company. Known as managed security services
providers (MSSPs), these organizations help their customers select, install,
and maintain state-of-the-art security policies and technical infrastruc-
Continued

www.syngress.com