Principles of Computer Security Key Terms 2 of 2

Intrusion prevention system (IPS) – A system to identify suspicious, malicious, or undesirable activity that indicates a breach in computer security and respond automatically without specific human interaction.

Misuse detection model – An IDS model where the IDS looks for suspicious activity or activity that violates specific policies and then reacts as it has been programmed to do. This reaction can be an alarm, e-mail, router reconfiguration, or TCP reset message.
Network tap – A connection to a network that allows sampling, duplication, and collection of traffic.
Network-based IDS (NIDS) – A system for examining network traffic to identify suspicious, malicious, or undesirable behavior.

Perimeter security – A technique where more and more companies operate their computer security like a castle or military base, with attention and effort focused on securing and controlling the ways in and out—the idea being that if you could restrict and control access at the perimeter, you didn’t have to worry as much about activity inside the organization.
Port mirroring – A technique where a mirrored port will see all the traffic passing through the switch or through a specific VLAN(s), or all the traffic passing through other specific switch ports. The network traffic is essentially copied (or mirrored) to a specific port, which can then support a protocol analyzer.

Protocol analyzer – A tool used by network personnel to identify packets and header information during network transit. The primary use is in troubleshooting network communication issues.

Signature database – A collection of activity patterns that have already been identified and categorized and that typically indicate suspicious or malicious activity.

Snort – The de facto standard IDS engine since its creation in 1998. It has a large user base and set the standard for many IDS element, including rule sets and formats. Snort rules are the list of activities that Snort will alert on and provide the flexible power behind the IDS platform. Snort rule sets are updated by a large active community as well as Sourcefire Vulnerability Research Team, the company behind Snort. Snort VRT rule sets are available to subscribers and provide such elements as same-day protection for items such as Microsoft patch Tuesday vulnerabilities. These rules are moved to the open community after 30 days.

Suricata – An open source IDS, begun with grant money from the U.S. government and maintained by the Open Source Security Foundation (OSIF). Suricata has one advantage over Snort: it supports multithreading.

Switched Port Analyzer (SPAN) – A technology employed that can duplicate individual channels crossing a switch to another circuit.

Traffic collector – Collects activity/events for the IDS to examine. On a HIDS, this could be log files, audit logs, or traffic coming to or leaving a specific system. On a NIDS, this is typically a mechanism for copying traffic off the network link—basically functioning as a sniffer. This component is often referred to as a sensor.