Intrusion Detection and Prevention

Unauthorized access to an organization's systems can impact all aspects of security, including confidentiality, integrity, and availability. Intrusions are often thought of as external attacks, but growing insider threats show this view is limited.

As systems become more complex and zero trust principles take hold, intrusions are better defined as any unauthorized, unauthenticated attempt to access a controlled part of the environment, regardless of the source.

Insiders, Outsiders, and Zero Trust

Some in the zero trust community argue that terms like insider and outsider distract from effective access control and lack relevance in identity and access management (IAM).

While these labels reflect human tendencies to think in terms of trust and inner circles, they do not align with zero trust principles that focus on verifying every access request, regardless of origin.

With enterprise-level organizations often reporting hundreds of thousands of attacks every day, detecting and preventing known threats is an essential task for security professionals.

Security professionals often discuss two general conceptual classes of intrusion security mechanisms: intrusion detection systems (IDSs) and intrusion prevention systems (IPSs).

An IDS is a solution that monitors the environment and automatically recognizes malicious attempts to gain unauthorized access.

The IDS will alert someone within the organization-usually someone in the security office or the IT department-for analysis and follow-up action.

By contrast, an IPS is a solution that monitors the environment and automatically acts when it recognizes malicious attempts to gain unauthorized access.

It will also typically notify someone within the organization that action has been taken.

ANGE

Most modern intrusion solutions will function as either IDS or IPS. The organization can customize the tool in the following ways:

• Perimeter placement. The IDS and IPS can be placed at the edge of the perimeter network, where it inspects traffic leaving and entering the network environment inside the demilitarized zone (DMZ). Depending on the IDS/IPS technology used, it can either work in tandem with gateway devices or fulfill the functions of the gateway connecting the perimeter network to the internet.
• Host-based. Host IDS (HIDS) and host IPS (HIPS) agents can be installed on various endpoint systems to detect malicious or suspect traffic between hosts. This adds a layer of defense in case an attacker was able to make it through perimeter defenses. Although not the primary goal of IDS and IPS, these agents may detect internal threats attempting unauthorized activity as well.
• Network-based. Network IDS (NIDS) and network IPS (NIPS) elements can be placed at various points of the network as a means to monitor internal traffic and recognize malicious or suspect activity internally. Like the host-based option, this can aid in efforts to create defense in depth (DiD) and possibly reveal internal threats.

IDS and IPS solutions can be deployed as host- or network-based and be located at various physical and logical locations in the IT environment.

The organization is not limited to a single placement choice—combining multiple placements of IDS/IPS is recommended.

IDS/IPS can detect malicious activity in several ways:

• Deviation. The IDS and IPS can learn a standard activity baseline that is normal for the organization. Deviations from this baseline of expected behavior are deemed suspect.
• Signature. The IDS and IPS can recognize known attack patterns in traffic and activity.
• Pattern matching. Some IDS and IPS systems provide the ability to scan traffic for predefined patterns of data values, such as fragments of certain names, words, or other data values used in certain combinations or in proximity to each other. Frequencies of occurrence, the presence of watermarks, or other characteristics might also suggest that sensitive information is attempting to flow in unauthorized directions, be that eastto-west across the organization or north-to-south (to the outside world or in from it).
• Heuristic. Machine-learning algorithms in the IDS and IPS can acquire more information about the environment as the tools operate, beyond a simple baseline. This is an advanced form of deviation analysis.