What IDS do

Reconfiguration of external devices (firewall or ACL on routers): it is a command sent by N-IDS to an external device (with a packet filter or firewall) so that it can be reconfigured immediately and can block an intrusion. This reconfiguration is possible by sending data that explains the alert (in the package header).

Sending an SNMP trap to an external supervisor (SNMP trap): sending an alert (and details of the data involved) in the form of an SNMP datagram to an external console such as HP OpenView Tivoli, Cabletron, Spectrum etc.

Sending an e-mail to one or more users: sending an e-mail to one or more mailboxes to report a serious intrusion.

Attack log: it is the backup of the details of the alert in a central database, including information such as the recording of the date, the IP address of the intruder, the IP address of the destination, the protocol used and the payload.

Suspicious packet storage: store all captured original packets and / or packets that triggered the alert.

Opening an application: launching an external program to perform a specific action (sending an SMS message, issuing an audible alert, etc.).

Sending a ResetKill: it is the construction of a TCP alert packet to force the end of a connection (valid only for intrusion techniques that use the TCP protocol).

Visual notification of an alert: is the display of the alert on one or more management consoles.
What are the challenges and characteristics of IDS
Editors and the specialized press increasingly emphasize the importance of replacing traditional IDS with IPS (intrusion prevention system) or at least making a distinction between them.

In fact, the intrusion prevention system is a system of prevention and protection against intrusions and not just a system of recognition and alerts, like most IDS. The difference between an IDS (network) and an IPS (network) lies mainly in two characteristics: the IPS is located on a line within the IPS network and does not passively listen to the network as an IDS (traditionally placed as a port tracker) network) and an IPS has the ability to immediately block intrusions, without worrying about the type of transport protocol used and without reconfiguring an external device. IPS can filter and block packets in native mode, using techniques such as dropping offensive packets or blocking an intruder (drop connection, drop offending packets, block intruder, etc.).

Comments

Post a Comment

Popular posts from this blog

The role of managed detection and response (MDR) in the area of ​​security

For organizations that want to maximize their security strategies, but cannot fund full-time security teams, initiatives like MDR can be a viable option. Why? To facilitate the work of security teams, when creating an incident response team, it is necessary to set up an organizational structure with a policy that is applicable and mainly effective. (this section seems a little out of place) Essentially, MDR is made up of security analysts and response analysts who examine an organization's records for suspicious events. For example: proactive threat detection and analysis, including vulnerability analysis, patches, firmware updates and monitoring of intrusion prevention and detection systems (  IDS / IPS  ). After registering a malicious activity, the team will do a more in-depth analysis. MDR is then responsible for researching threats and resolving incidents. This creates a delivery process for solving the analyzed case - such as notification to the customer, threat intelligence
Read more

What is help desk for the IT sector?

Now that you understand what help desk is , let's understand why it is so cited in the IT sector The help desk is a service offered by Information Technology companies , working as a technical support for areas related to computing. Thus, the employee of the contracting company, when he has a problem, opens a call to the IT team, which solves the problem. Some common problems are: not being able to access the Internet or the company's internal network, the printer is not working, etc. The questions worked on the help desk are low complexity problems and, therefore, are also called "first level of service". The second level of service is called Service Desk and will be explained in this article, but later. What are the help desk formats? The help desk can be aimed at the company's internal public, the external public or both. In addition, it can be a function of an internal team or an outsourced company ( outsourcing ). We will better understand these different fo
Read more

The AI-Powered Service Desk Will Transform Your Business in More Ways Than You Think

Image
Conversational AI can resolve this problem with the aid of automating numerous IT workflows, enabling the service desk to satisfy and exceed personnel’ expectations, and bringing the beleaguered IT branch into the 21st century. In fact, we're already seeing the move toward this direction — consistent with Forrester, automation is about to cast off 20% of all service desk interactions in 2020. Solving for the employee experience Using synthetic intelligence to streamline techniques can increase place of work productivity via over 40%, in step with Accenture. While using artificial intelligence to convert a commercial enterprise cease-to-end may appear to be a hard goal, the simple steps undertaken to get there are honestly pretty smooth to implement. For instance, greater than 60% of service requests or queries raised can be resolved by means of the service desk before everything contact through an intelligent virtual agent. By automating L1 tickets consisting of user provisio
Read more