Hey everybody welcome to the next video.
So in the last week we talked about an ideas or an intrusion detection system.
In this video we're gonna be talking about IP us or intrusion prevention system.
Now this also builds upon an I.D. system so it's use to also identify possible attacks or intrusions.
It uses signature based or heuristics based.
It does alert the admin.
However it does one extra step and it will actively tried to block drop or fix the connection of some
in some way.
Normally this is a block of some kind.
So if if it sees an attack coming in it will immediately block the traffic.
What's important to note here is on network based systems.
This has to sit on the wire itself.
It cannot be just sitting on a tap.
Now for IP systems there's still two.
It's still a host based or a network based host basis pretty pretty similar to what the IDF system has.
However you're not going to find an IP system used nearly as often on a host as you will with a network
based device.
Now on hosts called honey pots which are hosts that administrators put up to be purposely vulnerable
have old software on it but it also runs a lot of prevention systems detection systems.
You might find in software like this installed on those type of systems because when attackers scanned
the network they're going to see this one is open and available to attack.
Let's say it's running and running a database it's running ELD app and we're sitting here with you know
default my secret connections and anonymous log in for old app.
And it's vulnerable to some remote code execution.
So they'll do that on purpose so that somebody attacks that machine sort of the rest of the network
and then don't know as soon as it happens because that machine has more detections than a standard one
does.
Now the network based that first line is actually incorrect.
It's it's not on a tap it's physically on the network itself it normally sits in front of or behind
a firewall.
Now what's important to understand here is that if this is mis configured you can bring down the whole
network if it is if it missed directs or interprets correct traffic as malicious traffic and it is set
to block malicious traffic.
You could have a serious issue or outage if this occurs.
Now this type of device because it sits inside the network in line with what the what the wire itself
you need to make sure that it has enough bandwidth and power to be able to handle all the traffic and
get it passed through in a reasonable way as well as make sure it's configured correctly.
If you don't do both of those things you have a strong possibility of causing some major issues when
it comes to running and ideas or an IPL system on an enterprise level.
Now again on smaller systems you're a smaller environment you're not going to see an IPR system relatively
because they're very expensive.
There are some of open source versions that you can use.
However in a general standpoint the enterprise is going to use an enterprise grade type software because
open source some open source software can handle a lot of traffic depending on what the organization
is doing.
But a lot of stuff at the scale of like for Google for example they're not going to be using some basic
open source stuff they might use a modified version of it but it's not going to use a standard right
off the shelf open source idea system and just slap that in between there.
Their main line for the users for the their customers to the internal network.
So it's important to understand the two differences here between ideas and IP yes and understand where
they could be used.
And when you're running an engagement need to understand that they could possibly be in place.
So if you find yourself running Nick auto for a web web application scan and all of a sudden it's working
working working and then dies after a small amount of time you can probably have a good chance that
there's an IP system in place locking that connection later or if you are accessing a web application
Fine and you start doing local file inclusion.
You start then you do look a final push for some small files then you're good.
But when you do pass WD as an example or boot I and I for Windows you end up running into an issue where
all of a sudden now the connection dies.
So in those particular cases you're probably running into an IBM system.