d

Intrusion Prevention Systems: The Complete Documentation

• This category contains 4 Papers
• The last paper was added on 2007-03-26 (YYYY-MM-DD)

Intrusion Prevention Systems

Published on 2007, by Mike Barkett, ©NFR Security, Inc..

The explosion of the Internet and e-Commerce has caused organizations to become more vulnerable to electronic malice than ever before. With the increasing quantity and sophistication of attacks on IT assets, companies have been suffering from breach of data, loss of customer confidence and job productivity degradation, all of which eventually lead to the loss of revenue. According to a 2002 CSI/FBI survey on US corporations, government agencies, financial institutions, medical institutions and universities, 90% of respondents detected computer security breaches in the preceding 12 months. Eighty percent acknowledged financial loss due to the breaches and organizations that quantified their damages reported $456 million lost due to compromises, and this number has only grown since. Moreover, as unskilled, unmanned attacks such as worms and viruses multiply, the probability of attack approaches 1 for every organization. The question therefore shifts from whether an attack will occur, to when an attack will occur. Thus, a sound IT security plan is more important than ever, and the protection provided by current and emerging Intrusion Prevention Systems (IPS) is becoming a critical component.

Intrusion Prevention Systems (IPS)

Published on 2003, by Secure Computing Corporation., ©Secure Computing Corporation..

Protecting networked applications from attackers that threaten application availability, data-base integrity, data-presentation integrity, and data privacy is on the forefront of IT security professionals’ minds today. The term Intrusion Prevention has recently moved to the top of the buzz-factor charts in the security world, hence most security and IT professionals are becoming interested in learning more about it as quickly as possible. To begin understanding what the buzz about Intrusion Prevention is really all about, we need to begin by agreeing that the term itself can mean different things depending upon who is doing the talking. Remember SSO, PKI, and IDS? Today’s high buzz-factor three letter acronym, IPS (Intrusion Prevention System), joins a long line of next-generation security-technologies that promised to lead us to a higher level of security nirvana and peace of mind—so be advised.

Intrusion Prevention Systems (IPS)

Published on 2004, by NSS Group, ©NSS Group.

In a recent survey commissioned by VanDyke Software, some 66 per cent of the companies who responded said that they perceive system penetration to be the largest threat to their enterprises.

The survey revealed that the top eight threats experienced by those surveyed were viruses (78 per cent of respondents), system penetration (50 per cent), DoS (40 per cent), insider abuse (29 per cent), spoofing (28 per cent), data/network sabotage (20 per cent), and unauthorised insider access (16 percent).

Although 86 per cent of respondents use firewalls (a disturbingly low figure in this day and age, to be honest!), it is apparent that firewalls are not always effective against many intrusion attempts. The average firewall is designed to deny clearly suspicious traffic - such as an attempt to telnet to a device when corporate security policy forbids telnet access completely - but is also designed to allow some traffic through - Web traffic to an internal Web server, for example.

Intrusion Prevention Systems: the Next Step in the Evolution of IDS

Published on 2007-02-24, by Neil Desai, ©securityfocus.

You blended your IDS with my firewall! No, you blended your firewall with my IDS! Either way, when you combine the blocking capabilities of a firewall with the deep packet inspection of an IDS, you get the new kid on the block: intrusion prevention systems or IPS.

So what exactly is an IPS? Like most terms, it depends on whom you ask. The definition of IPS that we are going to use is any device (hardware or software) that has the ability to detect attacks, both known and unknown, and prevent the attack from being successful. Now that firewalls can keep track of TCP sequence numbers and have the ability to block certain type of traffic (such as Code Red or Nimda) even they can act as intrusion prevention systems. However, this is not what we are going to look at. Rather, this discussion will look at five different categories of IPSs that focus on attack prevention at layers that most firewalls are not able to decipher, at least not yet. The five types of IPSs that we will look at are inline NIDS, application-based firewalls/IDS, layer seven switches, network-based application IDSs, and deceptive applications.