Intrusion Prevention Flashcards

IPS (Intrusion Prevention System): Inline device that can block malicious traffic before it reaches its destination. Sits in the traffic path; examines every packet; drops threats in real time. IDS (Intrusion Detection System): Passive device that can only alert on suspicious traffic. Not in the traffic path; receives traffic copies; cannot block anything. The same hardware can operate as either, depending on how it is deployed. The exam rule: inline = IPS (prevention); passive = IDS (detection only). If an "IPS" is deployed via SPAN port, it is functionally an IDS — it cannot block.

A failure mode for inline security devices: when the device fails or becomes unavailable, traffic continues to flow through it without inspection. The device becomes transparent — no packets are examined, no attacks are blocked, but the network remains operational. Fail-open prioritizes availability over security during the failure window. Most enterprise networks prefer fail-open because network downtime has immediate operational impact. The security gap (uninspected traffic) is accepted as the lesser risk, mitigated by other security layers still in place (firewalls, endpoint protection).

A failure mode for inline security devices: when the device fails, traffic stops flowing through that link — the network connection is severed. No uninspected traffic reaches the protected segment, but the segment is unreachable until the device is restored. Fail-closed prioritizes security over availability. Appropriate for classified networks, critical infrastructure segments, and high-value targets where uninspected access is unacceptable. Requires rapid repair procedures because network downtime begins immediately on device failure.

An IPS deployment where the device sits directly in the traffic path between two network segments. All traffic must pass through the device; it evaluates each packet and either forwards or drops it. This is the configuration that enables real-time prevention — malicious packets are dropped before reaching their destination. Trade-off: adds latency; device failure impacts network availability (fail-open or fail-closed). Active monitoring is the default and required configuration for a device operating as an IPS. Internet → Firewall → [IPS] → Core Switch.

An IDS/IPS deployment where the device receives a copy of traffic via SPAN port or network tap — not the original traffic. Traffic flows normally to its destination; the monitoring device receives duplicates for analysis. Cannot block in real time — the original packet is already delivered by the time analysis completes. Device failure has no effect on network traffic. Used when: inline placement is not feasible; false positives would cause unacceptable disruption; availability cannot be risked (SCADA, medical); full packet capture for forensics is required. An IPS in passive mode = IDS behavior.

A managed switch feature that duplicates traffic from specified ports and delivers exact copies to a designated monitoring port. The monitoring device (IDS/IPS, packet analyzer) connects to the SPAN port and receives traffic without being in the data path. Configuration: software only — no additional hardware required beyond the monitoring device. Limitation: under heavy load, switches may drop SPAN copies (lower priority than regular forwarding) — creating monitoring gaps. Alternative: a physical network tap provides 100% packet fidelity but requires hardware installation. Also called a port mirror. SPAN → passive monitoring → IDS behavior.

A hardware device inserted directly into a physical network cable that passively copies all signals at Layer 1 and delivers them to a monitoring device. Unlike a SPAN port, a tap operates at the physical layer and has no software processing that can crash or drop packets — providing 100% capture fidelity under any traffic load. Most passive taps maintain the cable connection even if the tap loses power. Preferred over SPAN for: forensics requiring complete packet capture; compliance monitoring; critical links where no packets can be missed. Trade-off: requires physical hardware installation; not reconfigurable via software.

An IDS/IPS method that matches network traffic against a database of known attack patterns. Each signature describes a specific exploit, vulnerability, or attack sequence — a byte pattern, an HTTP request format, a known malicious payload. Matches trigger alerts or blocking actions. Strength: very low false positives for known threats; deterministic. Weakness: completely blind to zero-day attacks (no signature exists); requires continuous database updates. Signature databases are maintained by security vendors and updated as new exploits are published and reverse-engineered. Best for: known malware families, known exploit frameworks, compliance requirements for specific CVEs.

An IDS/IPS method that establishes a baseline of normal network behavior and generates alerts when traffic deviates significantly. Does not require a signature for the attack — any behavior that is statistically abnormal triggers investigation. Strength: can detect zero-day attacks; novel techniques; insider threats that have no matching signature. Weakness: higher false positive rate (unusual but legitimate traffic triggers alerts); requires stable baseline calibration; major network changes require re-baselining. Best for: detecting novel attacks, C2 communication patterns, insider threats, behavioral indicators that signature databases do not cover.

False positive: Legitimate traffic flagged as malicious. In an IDS: spurious alert (annoyance). In an inline IPS: blocked legitimate traffic (operational incident — applications fail). False positives drive IPS tuning: overly aggressive rules generate outages. False negative: Malicious traffic not detected or blocked. The attack passes through without generating an alert. Caused by: no matching signature (zero-day); attacker evasion techniques; detection threshold set too low to reduce false positives. The fundamental tension: reducing false positives (loosening rules) increases false negatives, and vice versa. Tuning is the ongoing process of finding the right balance for a specific environment.