Deciding instead of reporting

One attack, two systems

An exploit attempt arrives for a web server: a crafted request whose signature is in the database.

An intrusion detection system sees it, matches it, writes a log line and raises an alert. The request reaches the server. Whether the attack succeeds depends on the server, and somebody has to read the alert for anything else to happen.

An intrusion prevention system sees it, matches it, and drops the packet. Nothing reaches the server.

That is the whole of the distinction: an IPS is an IDS with the authority to act, blocking or modifying network packets at a perimeter or into a host, or blocking or modifying system calls on a host. Like an IDS it may be host-based, network-based or distributed, and may use anomaly or signature detection.

And the difference is not free. A false positive in an IDS is noise; a false positive in an IPS is an outage. The same detection accuracy that produces an annoying alert stream produces, once you attach the authority to block, a self-inflicted denial of service against your own users. That is the real reason organisations run detection for a while before enabling prevention.

The book is candid about a related point: a network IPS blocks traffic much as a firewall does, but decides when using IDS-style algorithms, and whether that makes it a new product category is a matter of terminology. The concrete difference is the decision rule. A firewall decides from policy about addresses, ports and protocols. A network IPS decides from detection algorithms about content and behaviour.

Host-based and network-based

A HIPS protects one machine, and addresses modification of system resources (rootkits and Trojans altering libraries, accounts, registry settings), privilege escalation, buffer overflows, access to the e-mail contact list, and directory traversal. Its four protection areas are system calls, file-system access, registry settings and host input/output — and the justification for the first is one sentence worth memorising: any exploit code will execute at least one system call, so a monitor placed there cannot be gone around. A HIPS also sandboxes mobile code, running an applet or script in isolation and halting it the moment it violates policy, before it reaches the normal environment.

A NIPS is, in the book's phrase, essentially an inline NIDS with the authority to modify or discard packets and tear down TCP connections. Its distinctive technique is flow data protection: the application payload is reassembled across a sequence of packets, filters run against the whole flow each time a new packet arrives, and once the flow is judged malicious that packet and every subsequent packet of the flow are dropped. That is the answer to fragmentation and segmentation evasion, and it is also why a NIPS costs far more per packet than a filter. It identifies malicious traffic five ways: pattern matching (byte sequences in single packets), stateful matching (signatures in the context of a stream), protocol anomaly (deviation from the RFCs), traffic anomaly (a UDP flood, an unexpected new service) and statistical anomaly (deviation from a throughput baseline). Pattern matching against stateful matching is single-packet against stream — the same distinction as stateless against stateful filtering, one layer up.

A distributed IPS correlates host and network sensors centrally and pushes updated signatures and behaviour patterns back out to every coordinated system. Snort Inline is the named example, adding drop, reject (which also returns a TCP reset or an ICMP port-unreachable) and sdrop (reject silently), plus a replace option that modifies packets instead of discarding them — used in a honeypot so that attackers watch their exploits fail without being able to work out why.

Unified threat management

A UTM appliance integrates several functions in one box. Its definition is by minimum feature set, not architecture: to qualify it must be capable of network firewalling, network intrusion detection and prevention, and gateway anti-virus — and crucially those capabilities need not all be switched on, they only have to be inherent in the appliance. Traffic is decrypted if necessary, filtered by an initial firewall module, passed through per-packet and per-flow engines driven by a data analysis engine that also reassembles multi-packet payloads so the anti-virus and web-filtering modules see complete content, re-encrypted where needed, reported to logging and forensics, and finally shaped for quality of service. The dominant issue is performance: throughput losses around 50% are typical, which is the price of chaining that much inspection in one path.

What a firewall can and cannot do

Finally, the summary the exam asks for directly. Four capabilities: a firewall defines a single choke point that keeps unauthorised users out and blocks vulnerable services, including protection from IP spoofing and routing attacks; it provides a location for monitoring security events; it is a convenient platform for non-security functions such as network address translation and usage logging; and it is the natural platform for IPsec, implementing VPNs in tunnel mode.

Four limitations, and the trick is that every one of them is a way of violating design goal 1 — all traffic must pass through the firewall:

1. It cannot protect against traffic that bypasses it — a host with its own broadband link, or a direct connection to a partner organisation.
2. It may not protect against internal threats — a disgruntled employee, or one cooperating with an outsider.
3. An improperly secured wireless LAN may be reachable from outside, and an internal firewall cannot police wireless traffic between systems on opposite sides of it.
4. A laptop or storage device infected outside and then carried in and attached bypasses the perimeter entirely.

Remember them as four ways round the perimeter rather than as a list, and they stay recoverable under exam pressure. Notice too that limitation 4 has grown rather than shrunk since the taxonomy was written: it is now most of what endpoint security exists to answer.