IPS: essential protection for your client workstations

Viruses, spyware, Trojans, malicious codes of all kinds ... Their number continues to grow, the Internet being their main vector of propagation. The Google search engine alone would account for several million infected web pages. Nothing surprising when the sale of kits allowing anyone to develop and launch their own attack proliferates. Becoming a cybercriminal is now within everyone's reach…


Workstation security has for a long time been limited to the use of an antivirus and a firewall. But today, this level of protection is far from sufficient to effectively secure the workstation and the data it contains. Based on signature databases, antivirus systems do not evolve at the same rate as the creation of new malicious programs. Hackers adapt and use variants of viruses that go beyond these traditional protections. Increasingly complex Internet browsers and office software are subject to exploitable security vulnerabilities. Computer threats are everywhere.

In the event of successful attacks, the harmful effects on the company are multiple: lower productivity, lower turnover, loss of credibility, affected image ... Not to mention the fact that the time spent eradicating this malware has a cost .

Only intrusion detection and prevention systems (Host-based Intrusion Prevention System or H-IPS) can effectively protect client workstations from unknown threats, targeted attacks or zero-day attacks. Unlike the antivirus, the performance of the HIPS is not based on signature databases but on an intelligent detection mechanism. It will thus detect any program with abnormal behavior on the workstation and block it instantly, even before it runs. Your computers and the critical data they contain are secure, financial losses and potential damage to the reputation of your business are limited.

Read More:  ips security

choosing an IDS / IPS solution for PCI DSS

Whether you opt for an NIDS or NIPS solution in an appliance, as a software or as a firewall module, a series of criteria that must be taken into account when choosing and deploying a solution are described below. Incident monitoring in a PCI DSS compliance environment:

• You must have signature-based detection, anomaly analysis and support for state inspection (stateful protocol analysis)
• It should be able to analyze the perimeter of the PCI DSS network and the segments that are considered critical. In this case, analyze the option of deploying different sensors in the critical areas to be monitored
• The solution should allow customization of alerts and detection criteria, in order to manage false positives and add new detection / prevention controls additional to those provided by the manufacturer
• The solution must allow to be updated on a regular basis, both for its components and for its signatures. Keep in mind that rebooting of the equipment is often required to finalize the updates, so it is essential to manage your updates based on what is described in requirement 6.4.5 to avoid unavailability of the control that can lead to a vulnerability in the environment
• In the case of appliances, keep in mind the scalability of the device and the density of network ports, including management ports

Likewise, it is recommended:

• Before putting an IDS / IPS solution into production, define a “learning” period in which the device can capture, analyze and obtain statistical information on the normal behavior of the network in order to establish thresholds for anomaly detection
• If an inline IDS / IPS solution is deployed, keep in mind that this equipment can become a single point of failure, so it may be necessary to install devices in high availability in case of failures and perform periodic analyzes of equipment performance to prevent bottlenecks
• When monitoring traffic coming from open public networks, ensure that the IDS / IPS sensor can access the traffic in clear text, otherwise it will not be possible to monitor encrypted traffic
• Ideally, the solution should be able to link to the centralized event registration system (req. 10.5.3 and 10.5.4) and send alerts using different channels (email, SMS, etc.)
• It is recommended to validate if the solution allows integration with other security devices, such as the reconfiguration of rules in firewalls and switches in response to the detection of an intrusion
• Analyze the security features of the solution for self-defense in case of targeted attacks
• If virtualization solutions are available, consider the need to monitor the network segments on this type of platform (including virtual switch)

What is managed security?

Managed Security includes intelligent, automated and customized security management solutions. Whatever the needs of your company.

The supervision and administration of company security is an increasingly complex task:

On the one hand, cyber threats are increasingly sophisticated. There are a large number of latent threats capable of rapidly mutating.

The traditional perimeter of corporate security has disappeared and possible entry points have multiplied. To traditional teams, we must add the irruption of mobile devices, cloud, social networks, and so on.

We cannot forget either the need to comply with multiple regulations, the safeguarding of the brand and reputation. We must protect the competitive advantage and guarantee customer satisfaction. Also look for efficiencies through automation to achieve cost reduction.

In response to this context, a series of products grouped under the term Managed Security Services are emerging in the cybersecurity market . These group usual services in this field (antivirus programs, firewalls, intrusion detection, updates, security auditing, content filtering, etc.), but adopting a new approach to the company's security needs. Based on this new approach, these services are managed by a third party that assumes responsibility for them to remain operational and monitored at all times .

In summary, a security service provider ((MSSP) for English managed security services provider) helps your organization by protecting your IT environment and mitigating the risks associated with security management. For this, it analyzes any vulnerability and subsequently applies the necessary solutions.

Advantages of Managed ids ips Services :

Cost reduction: using a managed security service usually saves costs compared to the option of an organization investing in its own personnel, software and hardware.

Increase in experience and quality of service: outsourcing services is a good solution especially for small and medium enterprises, with problems to have qualified personnel in this area.
Security systems 24 hours a day and 365 days a year : many companies can only guarantee them during normal business hours.

Efficiency: greater agility in the policies of backups or in the management of patches and updates, among others.

IPS CHARACTERISTICS

The term IPS ( Intrusion Prevention System ), which replaces the “traditional” IDS or makes a distinction between them, increasingly resonates .

An IPS is a prevention / protection system to defend against intrusions and not only to recognize and report on them, as most IDS do. There are two main features that distinguish an IDS (network) from an IPS (network):

The IPS is placed online within the IPS network and not only passively listens to the network as an IDS (traditionally placed as a port tracker in the network).

The IPS has the ability to immediately block intrusions, regardless of the transport protocol used and without reconfiguring an external device. This means that the IPS can filter and block packets in native mode (by using techniques such as dropping a connection, dropping offensive packets, blocking an intruder, etc.).

we will see an example of how to configure the IDS / IPS SNORT, this is the one that is being used in operating systems such as LINUX, although there is also a version for Windows.

HOW AN IDS WORKS

The main methods used by N-IDS to inform and block intrusions are:

Reconfiguration of external devices (firewalls or ACLs on routers): Command sent by the N-IDS to an external device (such as a packet filter or a firewall) to reconfigure immediately and thus block an intrusion. This reconfiguration is possible by sending data explaining the alert (in the package header).

Sending an SNMP trap to an external hypervisor: Sending an alert (and details of the data involved) in the form of an SNMP datagram to an external console such as HP Open View Tivoli, Cabletron, Spectrum, etc.

Sending an email to one or more users: Sending an email to one or more mailboxes to report a serious intrusion.

Attack log: Alert details are stored in a central database, including information such as date log, intruder IP address, destination IP address, protocol used and payload.

Storage of suspicious packages: All original captured packages and / or packages that triggered the alert are saved.

Opening an application: An external program is launched that performs a specific action (sending an SMS text message or issuing an audible alarm).

Sending a “ResetKill”: A TCP alert packet is constructed to force the termination of a connection (only valid for intrusion techniques that use the TCP transport protocol).

Visual notification of an alert: An alert is displayed on one or more of the management consoles.