Instructor Materials – Chapter 5: Implementing Intrusion Prevention
Chapter Outline:
5.0 Introduction
5.1 IPS Technologies
5.2 IPS Signatures
5.3 Implement IPS
5.4 Summary
Section 5.1: IPS Technologies
Topic 5.1.1: IDS and IPS Characteristics
- Zero-Day Attacks
- Monitor for Attacks
- Detect and Stop Attacks
- Similarities Between IDS and IPS
- Advantages and Disadvantages of IDS and IPS
Topic 5.1.2: Network-Based IPS Implementations
- Host-Based and Network-Based IPS
- Network-Based IPS Sensors
- Cisco’s Modular and Appliance-Based IPS Solutions
- Choose an IPS Solution
- IPS Advantages and Disadvantages
- Modes of Deployment
Topic 5.1.3: Cisco Switched Port Analyzer
- Port Mirroring
- Cisco SPAN
- Configuring Cisco SPAN Using Intrusion Detection
Section 5.2: IPS Signatures
Topic 5.2.1: IPS Signature Characteristics
- Signature Attributes
- Signature Types
- Signature File
- Signature Micro-Engines
- Download a Signature File
Topic 5.2.2: IPS Signature Alarms
- Signature Alarm
- Pattern-Based Detection
- Anomaly-Based Detection
- Policy-Based and Honey Pot-Based Detection
- Benefits of the Cisco IOS IPS Solution
- Alarm Triggering Mechanisms
Topic 5.2.3: IPS Signature Actions
- Signature Actions
- Manage Generated Alerts
- Log Activities for Later Analysis
- Deny the Activity
- Reset, Block, and Allow Traffic
Topic 5.2.4: Manage and Monitor IPS
- Monitor Activity
- Monitoring Considerations
- Secure Device Event Exchange
- IPS Configuration Best Practices
Topic 5.2.5: IPS Global Correlation
- Cisco Global Correlation
- Cisco SensorBase Network
- Cisco Security Intelligence Operation
- Reputations, Blacklists, and Traffic Filters
Section 5.3: Implement IPS
Topic 5.3.1: Configure Cisco IOS IPS with CLI
- Implement IOS IPS
- Download the IOS IPS Files
- IPS Crypto Key
- Enable IOS IPS
- Load the IPS Signature Package in RAM
Topic 5.3.2: Modifying Cisco IOS IPS Signatures
- Retire and Unretire Signatures
- Change Signature Actions
Topic 5.3.3: Verify and Monitor IPS
- Verify IOS IPS
- Report IPS Alerts
- Enable SDEE
Section 5.4: Summary
Chapter Objectives:
- Describe IPS technologies and how they are implemented.
- Explain IPS Signatures.
- Describe the IPS implementation process.
