Intrusion Detection - Secure Computing SG300 User Manual

Intrusion Detection

Note
The SG300, SG530, SG550, SG560, SG570, and SG630 provide Basic Instrusion
Detection and Blocking only.
The SnapGear unit provides two intrusion detection systems (IDS): the lightweight and
simple-to-configure Basic Intrusion Detection and Blocking, and the industrial strength
Advanced Intrusion Detection and Prevention.
These two systems take quite different approaches. Basic Intrusion Detection offers a
number of dummy services to the outside world, which are monitored for connection
attempts. Clients attempting to connect to these dummy services can be blocked.
Advanced Intrusion Detection uses complex rulesets to detect known methods used by
intruders to circumvent network security measures, which it either blocks or logs to a
remote database for analysis.
Read on to find out how using an IDS can benefit your network's security, or skip ahead
to the Basic or Advanced Intrusion Detection section for an explanation of configuration
options.
The benefits of using an IDS
External attackers attempting to access desktops and servers on the private network
from the Internet are the largest source of intrusions. Attackers exploiting known flaws in
operating systems, networking software and applications, compromise many systems
through the Internet.
Generally firewalls are not granular enough to identify specific packet contents that signal
an attack based on a known system exploit. They act as a barrier analogous to a
security guard screening anyone attempting to enter and dismissing those deemed
unsuitable, based on criteria such as identification. However, identification may be
forged. On the other hand intrusion detection systems are more like security systems
with motion sensors and video cameras. Video screens can be monitored to identify
suspect behavior and help to deal with intruders.
Firewalls often easily bypassed through well-known attacks. The most problematic types
of attacks are tunneling-based and application-based. The former occurs when an
attacker masks traffic that should normally be screened by the firewall rules by
encapsulating it within packets corresponding to another network protocol. Application-
based attacks occur when vulnerabilities in applications can be exploited by sending
suspect packets directly with those applications.
Firewall
163