Intrusion Prevention Systems

1. Intrusion Prevention Systems Presented by Justin Bode CS 450 – Computer Security February 17, 2010

2. Video To show importance of network security http://vimeo.com/7151210

3. Introduction Why the need for IPS?

4. Other Forms of Protection • Anti-Virus Programs • Need to be updated constantly – Might be too late • React rather than protect • Firewalls • Can block traffic but needs to allow some through • Attacks can still get in • Intrusion Detection Systems • Scans the network for signs of intrusion • Merely reports – Requires user action to stop attacks • IDS evasion techniques are becoming common

5. Intrusion Prevention Systems How do they work? Types of IPS?

6. How IPS Works • Software based heuristic approach • Similar to IDS but has added functionality to block • Sandbox • Runs mobile code in isolated environment and looks at the result • Hybrid • Uses multiple detection methods and blocks imminent attacks • Kernel Based Protection • Agent installed between user application and kernel • Malicious system calls are blocked.

7. Types of IPS • Network based • Inline hardware systems • Uses signature, anomaly, and proprietary detection methods • Traffic normalization – removes protocol ambiguities to ensure the NIPS sees the same thing as the end host • Cons? • High rate of false positives • What if NIPS goes down?

8. Types of IPS

9. Types of IPS • Host based • Installed on host computer • Hooks onto kernel and looks at all system calls • If system call isn’t normal, it is blocked. • Use of “interceptors” - StormWatch • File system • Network • Configuration • Execution space • Cons? • Resource intensive – checking all calls, sandboxing

10. Types of IPSStormWatch

11. Questions? I’ll answer if I know it

12. References SANS Institute – Intrusion Prevention Systems by DineshSequeira November 2002 Wikipedia – Intrusion Prevention Systems (For the basic stuff)