Usec 4.1

Intrusion

Occurs when an attacker attempts to gain entry into or disrupt the normal operations of an organization’s information systems.

Intrusion prevention

Consists of activities that deter an intrusion.

Intrusion detection

Consists of procedures and systems that identify system intrusions.

Intrusion reaction

Encompasses actions an organization undertakes when an intrusion event is detected.

Intrusion correction activities

Complete restoration of operations to a normal state and seek to identify source and method of intrusion.

Network-based IDPS (NIDPS)

Resides on a computer or an appliance connected to a segment of an organization’s network; looks for indications of attacks. Focused on protecting network information assets.

Wireless IDPS

Focuses on wireless networks; monitors and analyzes wireless network traffic.

Network behavior analysis IDPS

Examines traffic flow on a network in an attempt to recognize abnormal patterns and identify problems related to the flow of traffic.

Host-based IDPS (HIDPS)

Resides on a particular computer or server (host) and monitors activity only on that system.

Signature-based detection

Examines network traffic in search of patterns that match known signatures.

Anomaly-based detection (or behavior-based detection)

Collects statistical summaries by observing traffic known to be normal.

Stateful protocol analysis (SPA)

Process of comparing known normal/benign protocol profiles against observed traffic.

Log file monitor (LFM)

Reviews log files generated by servers, network devices, and even other IDPSs for patterns and signatures.

Active response

Collecting additional information about the intrusion, modifying the network environment, taking action against the intrusion.

Passive response

Setting off alarms or notifications, collecting passive data through SNMP traps.

Centralized control strategy

All IDPS control functions are implemented and managed in a central location.

Fully distributed control strategy

All control functions are applied at the physical location of each IDPS component.

Partially distributed control strategy

Combines the two; while individual agents can still analyze and respond to local threats, they report to a hierarchical central facility to enable organization to detect widespread attacks.

Honeypots

Decoy systems designed to lure potential attackers away from critical systems.

Honeynets

Several honeypots connected together on a network segment.

Padded cell system

Protected honeypot that cannot be easily compromised.

Trap-and-trace systems

Use a combination of techniques to detect an intrusion and trace it back to its source.

Enticement

Act of attracting attention to system by placing tantalizing information in key locations.

Entrapment

Act of luring an individual into committing a crime to get a conviction.

Scanning tools

Typically are used to collect information that an attacker needs to launch a successful attack.

Attack protocol

A logical sequence of steps or processes used by an attacker to launch an attack against a target system or network.

Footprinting

Process of collecting publicly available information about a potential target.

Fingerprinting

Systematic survey of target organization’s Internet addresses collected during the footprinting phase to identify network services offered by hosts in that range.

Port Scanners

Tools used by both attackers and defenders to identify/fingerprint computers active on a network and other useful information.

Firewall Analysis Tools

Tools that automate remote discovery of firewall rules and assist the administrator/attacker in analyzing them.

Operating System Detection Tools

Tools that use networking protocols to determine a remote computer’s OS.

Active vulnerability scanners

Examine networks for highly detailed information and initiate traffic to determine security holes.

Passive vulnerability scanners

Listen in on network and identify the vulnerable versions of both server and client software.

Packet Sniffers

Network tool that captures copies of packets from network and analyzes them.