-: NIDS versus NIPS.
Now, we've already spoken a little bit about
intrusion detection and intrusion prevention systems
earlier on in this course.
In this lesson, though, we're going to focus
on the differences between a network-based IDS
and a network-based IPS.
A Network Intrusion Detection System,
or a NIDS, is a type of IDS that attempts
to detect malicious network activities,
for example, port scans and denial of service attacks.
Now, this is a device that's usually placed
either before the firewall, so that
it can be directly exposed to all
of the traffic that's coming in,
or right behind the firewall.
Personally, though, I like to have my NIDS
placed behind the firewall, as this helps
filter the amount of traffic that we'd
have to see and review, since the firewall
is already going to block a lot of it for us.
Generally, your Network Intrusion Detection System
will be placed into what's known as promiscuous mode.
This allows it to see all of the traffic
that crosses the network instead of just
the traffic that's destined for its own Mac address.
This is easily done through the configuration
of the NIDS, and by placing your NIDS
on a span port of your network switch
so that it can receive all of the traffic
moving through that switch, and not just
the traffic on its own switch port.
A NIDS can only detect, monitor, and alert
on traffic based on signature-based rules or heuristics,
and it won't do anything to actually stop
an attack from occurring.
When you're dealing with a NIDS,
all it's going to do is log it
and let you know about it.
A Network Intrusion Prevention System, or NIPS
on the other hand, is a type that's designed
to inspect traffic and based on
its configuration or security policy,
it can also remove, detain, or redirect
that malicious traffic.
That means a NIPS can not only detect it
and log it like an IDS does,
but it can also stop that ongoing attack
by blocking the IP address that's causing issues
or shutting down the connection.
But to be able to effectively take these actions,
the NIPS has to be installed in-line
in your network.
Again, I like to place my NIPS in-line,
just behind the firewall.
This way it's just inside the network perimeter
and it allows me to have a good vantage point for it.
Remember, when you're using a NIPS
to block an ongoing attack,
you want to ensure that the NIPS
is properly tuned.
If you didn't tune it properly
with the right signatures, you could have
a lot of false positives, and since
these would be terminated, it could cause
an inadvertent denial of service for your network
if it tries to prevent what it thinks
is malicious traffic from flowing into the network.
Now, because a NIPS is an in-line device,
you also have to think about what's going to happen
if that device fails.
Should that device fail open, or should it fail shut?
If you set the device to be configured
to fail open, this means that the NIPS
is going to simply let all of the traffic
through it whenever it fails.
This is less secure obviously,
and so you have to think about
if this is really what you want.
Now, if you choose to fail shut, on the other hand,
the device is going to block all the traffic
if it fails for some reason.
This means that it's going to create
a denial of service condition for your entire network,
which is also pretty bad.
For this reason, most organizations choose
to fail open with their Network Intrusion
Prevention Systems, and rely on
other defensive layers to provide
some layer of protection, until the NIPS
can be brought online again and fixed.
Now, in addition to providing their NIDS
and NIPS functions, these devices
also can be used as a protocol analyzer.
You may remember protocol analyzers
being discussed in your Network+ studies.
These are software products like Wireshark
or Network Monitor, and they're usually installed
on a machine and used to capture packets,
allowing an administrator to conduct analysis
on those packets and better troubleshoot
and secure the network by seeing patterns
in the packet captures.
Now, a NIPS or a NIDS may have
a built-in protocol analyzer embedded
into their system.
This is usually done to allow the device
to decode application layer protocols
like HTTP, SMTP, FTP, Telnet, and others.
And then, it passes that data that's contained
in those protocols, over to the signature engine
of the NIDS or the NIPS for further analysis.
This allows the devices to create
their own baseline of what normal looks like
for the network and also helps
to identify what abnormal might be for its
behavioral or anomalous traffic detection functions.
This functionality does require
additional processing resources though,
and so this can decrease the overall performance
of a NIDS or a NIPS when you utilize
this deep packet inspection.