© SANS Institute 200
8
,
Author retains full rights.
© SANS Institute 200
8
, Author retains full rights.
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Network IDS & IPS Deployment Strategies
network? Clearly the test environment is an important piece of modern information
technology shops.
For information security professionals attempting to evade IDS and IPS
detection a test case is very useful. Once such an individual feels they have their IPS
and IDS configured just right, they should seek a method to evade their
implementation. Likewise with someone who thinks they can sneak in, penetrating
the network unnoticed. They should then devise a method to block their covert
attack. This is an invaluable means to make even the smartest security professional
more capable.
As far as the Blackhats go, setting up a test case of an IDS/IPS to launch
attacks against may be beneficial in honing their craft.
As most security folks know,
being an effective member of any security team involves routinely wearing a black
hat (offensive) and then swapping it with that of a lighter shade of grey or white
(defensive); not unlike centuries of weapons development versus armor
development.
Outside the test environment, larger networks will find the administration of
numerous IDS/IPS sensors deployed across their enterprise network a daunting task.
Maintaining multiple IDS/IPS pairings is best done by utilizing a central database to
store the data gathered. In this case the sensors merely collect data and send it up
to a centralized database. Figure 8 shows a high level view of such an
implementation.
Nicholas Pappas
28
@ 2021 SANS Institute
Author Retains Full Rights
© SANS Institute 200
8
,
Author retains full rights.
© SANS Institute 200
8
, Author retains full rights.
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Network IDS & IPS Deployment Strategies
Figure 8: Distributed infrastructure of IPS/IDS sensors feeding a centralized database.
It is important to note, that each IDS/IPS pairing will have their own security
policy or rule set. What applies to Segment-1 may not apply to Segment-2 and so
on. Furthermore, having the data sent to a centralized location, will minimize the
number of highly skilled analysts the organization has to train and keep on the
payroll. This will obviously bring about the highest return on investment. On that
note, having one instance of data storage cuts down on the number of required
systems capable of storing mass amounts of data, not to mention the systems
required to conduct analysis on those large data stores. Centralizing analysis efforts
also leads to a more consistent interpretation.
The uses mentioned here are just a few of the many.
In reality the uses of
Nicholas Pappas
29
@ 2021 SANS Institute
Author Retains Full Rights
© SANS Institute 200
8
,
Author retains full rights.
© SANS Institute 200
8
, Author retains full rights.
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Network IDS & IPS Deployment Strategies
such a system are only limited to one's imagination or task orders.
