Network Security Systems and Firewalls

 

 


Network or host-based intrusion detection systems (IDS) and network or host-based intrusion prevention systems (IPS), along with firewalls, represent some of the tools available to defend networks and keep them secure. As you progress through the various labs and readings in this course, keep these fundamental security concepts in mind.

Complete the following for both IDS and IPS:

Examine two advantages and two disadvantages of each system.
Explain where you recommend using each system, or both systems, and why.
Provide a specific example of each system that meets the budget and defensive needs of a home or small office.
Include the strengths and weaknesses.
Provide a specific example of each system that meets the budget and defensive needs of a large corporate office.
Include the strengths and weaknesses.

 

 

Sample Answer

 

 

 

 

 

 

 

 

Both Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are crucial components of a modern network defense strategy, working alongside firewalls to monitor and control traffic.

 

Intrusion Detection System (IDS)

 

An IDS is a passive monitoring tool that detects suspicious activity and alerts security personnel without taking immediate action to stop the traffic.

 

Advantages and Disadvantages

 

TypeAdvantageDisadvantage
Advantage 1Low Network Impact: Since an IDS operates passively by mirroring traffic, it generally doesn't introduce latency or delay legitimate traffic.Disadvantage 1
Advantage 2Excellent Forensic Tool: It provides detailed logs of malicious traffic and activities, which are invaluable for post-incident analysis and investigation. 

Deployment Recommendation

 

I recommend using an IDS primarily for monitoring and forensic analysis, typically in parallel with an IPS. It should be placed after the firewall and behind the IPS (if present) or used to monitor sensitive internal network segments (Host-based IDS) because its strength lies in comprehensive logging without introducing a choke point for essential traffic.

 

Home/Small Office (Budget & Needs) Example

 

SystemExampleStrengthsWeaknesses
IDSSnort (Open Source Network-based IDS)Free and open-source; large community-maintained rule set; highly customizable.Requires a dedicated machine or virtual machine (VM) to run; complex setup and maintenance for non-technical users.

 

Large Corporate Office (Budget & Needs) Example

 

SystemExampleStrengthsWeaknesses
IDSSplunk or Elastic Stack (ELK) with Network Taps (NIDS)Centralized logging and correlation of massive traffic volumes; advanced machine learning for anomaly detection.High licensing and infrastructure cost; significant storage and processing power required for large-scale data retention.

 

Intrusion Prevention System (IPS)

 

An IPS is an active control tool that sits inline with network traffic, constantly inspecting packets and immediately dropping, resetting, or blocking traffic deemed malicious.

 

Advantages and Disadvantages

 

TypeAdvantageDisadvantage
Advantage 1Proactive Defense: It automatically stops threats in real-time before they reach internal systems, providing an immediate layer of defense.Disadvantage 1
Advantage 2Reduces Security Load: By automating the blocking of known threats, it significantly reduces the volume of simple, time-consuming alerts for security staff.