Intruder detection system - IDS

The Internet, as we know is an extremely important tool, we are increasingly dependent on it, and we provide services that can be accessed through the world wide web. But with that, new ways of circumventing network security, new internet points contaminated with viruses / trojans or other pests are emerging every moment, and if we have not prepared, we could be the next victim.

When we put our network on the Internet, we try to close all doors of unauthorized access. It is the same, that when we build our house, we try to put, gate, windows, doors, everything with locks and padlocks. Unfortunately, the bandits get better, and look for ways to invade your home, either by destroying the lock, breaking the windows, digging an access tunnel, or when out of distraction and without realizing it, we leave an open door so that the thief doesn't have any difficulty to invade your home. From the moment he managed to enter, it is to hope that the damage is not great.

An intrusion detection and prevention systems tool has the following basic principles:

• How many attempts at attacks do we suffer each day ?;
• What types of attacks were used ?;
• What are the origins of the attacks?

The IDS as we have seen is an essential part of a network security system, and with each passing day, this system gains great prominence. The growth of intruders and forms of invasions is proportionately linked to the growth of the Internet, so this security item on your network is mandatory, to give peace of mind and reliability to your users, suppliers and customers.

Our solution includes:

• Installation;
• First steps;
• Training;
• Documentation;
• 30-day Technical Support.

Commercial IDS / IPS Solutions

Gartner published its magic square for intrusion prevention systems ("Magic Quadrant for Intrusion Prevention Systems"), which can be a good benchmark for comparing different commercial IDS / IPS solutions. Some of the most notable are:

• Cisco (Sourcefire)
• McAfee Network Security Platform (NSP)
• Radware DefensePro IPS
• StoneSoft (McAfee)
• IBM Security Network Intrusion Prevention System

Keep in mind that there are Unified Threat Management - UTM solutions  that can contain IDS / IPS modules. Review with a QSA the validity of these platforms and their compliance with PCI DSS.

IDS / IPS Open Source Solutions

Listed below are some notable IDS / IPS solutions under OpenSource licensing:

• Meerkat
• Snort
• Bro

Technical reference: How to check if an IDS / IPS is generating alerts?

In order to ensure that the IDS / IPS solution implemented in the compliance environment generates the necessary alerts, it is necessary to develop periodic tests to validate the effectiveness and efficiency of intrusion detection. These tests can be linked to vulnerability scans (req. 11.2) and penetration tests (req. 11.3), using tools such as Nessus , Nmap or Metasploit .

On the other hand, a tool can be used that as such does not execute active attacks but injects in the network false (and harmless) traffic but belonging to real intrusions so that it is detected by the sensor, similar to how the antigens work in vaccines An example of these tools is IDSWakeUp . This script consists of two modules (IDSwakeup and iwu) that interact with hping2 and libnet to generate malicious traffic between two hosts.

Benefits of the Intrusion Prevention System for companies


Most organizations today can benefit from intrusion prevention systems, since the use of technologies dedicated to the use of hardware, software, and networks are part of the computational infrastructure of most companies, regardless of their type or sector.

• Intrusion Prevention System (IPS )technologies offer several benefits for organizations, let's look at three of the most significant benefits:
• Detects and stops attacks that other security controls do not
• Supports customization of discovery features to stop activities that are of interest to a single organization only
• It reduces the amount of network traffic that reaches other security controls, which reduces the workload for those controls and protects them from direct attacks.
• The most important benefit provided by the Intrusion Prevention System is undoubtedly the ability to detect and stop a variety of attacks that cannot be automatically identified by firewalls, antivirus, and other company security controls.
• The technology employed by IPS uses the combination of several methodologies to detect attacks. Each methodology has its own characteristics, so by using the strongest resources of each methodology, an IPS can detect a wide variety of attacks.
• Intrusion prevention systems are critical for most organizations to detect and stop network-based attacks, especially those that cannot be detected by other company security controls. Information security today has become a mandatory requirement to guarantee not only business continuity but also the certainty of respecting the privacy and integrity of customers and suppliers.