cisco企业ids解决方案

《cisco企业ids解决方案》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、AdvancedEnterpriseIDSDeploymentandTuningThePotentialImpacttotheBottomLineIsSignificantTheNumberofSecurityIncidentsContinuestoRiseExponentiallyTheComplexityandSophisticationofAttacksandVulnerabilitiesContinuestoRiseTheChallenge:SecurityinModernNetworksMitigatingtheRisk:Defensei

2、nDepthComprehensivesecuritypolicyPervasivesecurity—endtoendSecurityinlayersMultipletechnologies,workingtogetherDefenseinDepth:TheRoleofIntrusionDetectionComplementarytechnologytofirewallsBeenaroundformorethanadecade,startedcomingintoprominenceinthelate’90sPerformsdeeppacketins

3、pection,gainingvisibilityintodetailoftenmissedbyfirewallsInternetAdvancedEnterpriseIDSDeployment:AgendaIntrusionProtectionSystemsNetworkSensorsHostAgentsManagementConsolesCaseStudiesIntrusionProtectionSystemsIntrusionProtectionAgendaTerminologyandTechnologiesCompleteArchitectur

4、e:Sensors,Agents,ManagementConsolesPlacementStrategiesWheretoPlaceYourSensors,whatTraffictoWatch,HowtoGetTraffictoThemOrganization-LevelConcernsRespondingtoIntrusions,OwnershipandOrganization,OutsourcingIDSTerminology:FalsePositivesAFalseAlarmoccurswhenanIDSreportsanattackevent

5、houghnoattackisunderwayBenignactivitythatthesystemmistakenlyreportsasmaliciousTypicallyduetoimpropertuningCaneasilyoverwhelmalarmconsolescreatingenormousamountofbackgroundnoiseCanresultinmistrustoftheIDSbysecuritypersonnelIDSTerminologyFalseNegativesAFalseNegativeoccurswhenanID

6、SfailstoreportanongoingattackMaliciousactivitythatthesystemdoesnotdetectorreportTendtobeworsebecausethepurposeofanIDSistodetectsucheventsCanbeduetoavarietyofeventsCanbetheresultofIDSevasioneffortsbyanattackerCanalsobeduetoout-of-datesignatureknowledgebase(misusedetectionsystems

7、)Minorstatetransitionthatisbelowadetectablethreshold(anomaly-basedsystems)IDSTerminology:SignaturesandAnomaliesSignaturesexplicitlydefinewhatactivityshouldbeconsideredmaliciousSimplepatternmatchingStatefulpatternmatchingProtocoldecode-basedanalysisHeuristic-basedanalysisAnomal

8、ydetectioninvolvesdefining“normal”activityandlookingfo