What is IDS and IPS? How it works, how it differs from Firewall/WAF, and why companies need it

What is IDS/IPS? Basic concepts and roles

IDS (Intrusion Detection System)

An IDS is a security system that specializes in detecting unauthorized intrusions and unusual activity into networks and systems.
As the name suggests, "Detection" is the main function, and it issues alerts when attacks or anomalies are detected.

Simply put, IDS is like a "security surveillance camera".
Monitor suspicious movements 24 hours a day, 365 days a year and notify administrators when they find any issues.

IPS (Intrusion Prevention System)

IPS is a system that automatically blocks detected threats in addition to the detection functions of IDS.
As the name "Prevention" suggests, it not only detects attacks, but also defends against them in real time.

IPS acts like a "security guard" that detects suspicious intruders and stops them on the spot.

Difference Between IDS/IPS and Firewall and WAF

The differences between these security technologies can be summarized as follows:

Firewall:

• Basic access control at the network perimeter
• Filtering based on IP address and port number
• Allow/deny based on predefined rules

WAF（Web Application Firewall）：

• Defend against web application-specific attacks
• Detailed analysis of HTTP request content
• Support for application-layer attacks such as SQL injection and XSS

IDS/IPS：

• Monitor and prevent abnormal behavior across the network
• Detect attack patterns and anomalous communications
• Threat detection with broader and deeper analysis

In other words, if the Firewall is the "gatekeeper" and the WAF is the "professional security guard for the web app", the IDS/IPS is like the "security guard patrolling the premises".

How IDS/IPS Works

Detection Techniques

IDS/IPS detects threats in three main ways:

1. Signature-Based Detection

Databases of known attack patterns and matches them against communications to detect threats. It works like a pattern file of antivirus software.

Pros:

• High detection accuracy
• Less false positives
• Identify the type of attack

Cons:

• Unable to respond to unknown attacks
• Requires regular signature updates

2. Anomaly-based detection (anomaly detection)

It learns a baseline of normal network behavior and detects any deviations from it as abnormal.

Pros:

• Detect unknown attacks
• Respond to emerging threats
• Detects attacks from the inside

Cons:

• Potential for false positives
• Requires a learning period
• Difficult to identify the type of attack

3. Hybrid Detection

It is a combination of signature and anomaly-based techniques that leverage the best of both worlds.

Configuration

Network-Based IDS/IPS (NIDS/NIPS)

It monitors packets flowing through the network and analyzes the content of the communication.

Location:

• Network boundary (connection point to the Internet)
• Entrance to critical network segments
• Mirror port on the switch

Features:

• Enables monitoring of the entire network
• Protect multiple hosts at the same time
• Less impact on network equipment

Host-Based IDS/IPS (HIDS/HIPS)

Install agents on individual servers and endpoints to monitor activity within those hosts.

Features:

• Detailed monitoring of the host internals
• Detect file tampering and login attempts
• Encrypted communications can also be monitored

Top Threats IDS/IPS Detects and Protects Against

1. Network Intrusion Attacks

• Port scanning: An attacker's attempt to search for vulnerabilities in a system.
• Buffer overflow attacks: Attacks that target memory vulnerabilities
• DoS/DDoS attacks: Attacks on availability through denial-of-service attacks

2. Malware Activity

• Botnet communication: Communication between the infected machine and the C&C server
• Data exfiltration: External transmission of sensitive information
• Ransomware: File encryption and ransom demands

3. Insider Threats

• Privilege escalation: Normal users unauthorized acquisition of administrative privileges
• Data access anomalies: Unusual file access patterns
• Lateral movement: horizontal movement from one invaded system to another

4. Advanced Persistent Threat (APT) Attacks

• Long-term incubation: Advanced attacks that lurk in the system for a long time
• Targeted attacks: Continuous attacks targeting specific organizations
• Multi-stage attacks: Complex attacks that combine multiple techniques

Benefits and Challenges of Implementing IDS

Pros

1. Comprehensive Monitoring Capabilities

• 24/365 monitoring: Continuous monitoring is not possible with humans
• Enhanced defense-in-depth: Comprehensive defense combined with Firewall and WAF
• Increased visibility: Know what's happening on your network

2. Faster Incident Response

• Early detection: Detect early attacks to minimize damage
• Detailed Logs: Analyze attack techniques and paths in detail
• Trail Preservation: Preserve evidence necessary for legal action and forensic investigations

3. Compliance

• Meeting regulatory requirements: Compliance with various security standards
• Audit Response: Provide trails during security audits
• Risk management: Strengthening the company's risk management system

Challenges

1. False Positive Problems

• Alert fatigue: Risk of missing important alerts due to high volume of false positives
• Operational load: increased burden on operations teams due to false positive confirmation work
• Tuning Needs: Requires continuous adjustments to the environment

2. Operational Complexity

• Need for Expertise: Requires a high level of expertise for proper setup and operation
• 24-hour monitoring: Establish a real-time monitoring and response system
• Ongoing maintenance: Regularly perform signature updates and rule adjustments

3. Performance Impact

• Network Latency: Impact of traffic analysis on communication speed
• Resource Consumption: Consuming system resources through advanced analytics
• Scalability: Ensures performance as the network scales

IDS/IPS Operational Best Practices

1. Proper Placement Design Key Points:

• Placement at the network perimeter and critical segments
• Placement to maximize traffic visibility
• Designed to minimize performance impact

2. Tuning and Optimization Implementation:

• Customize rulesets according to your environment
• Whitelist settings to reduce false positives
• Regular rule updates based on attack trends

3. Establishment of a monitoring and operation system Necessary system:

• 24 hours a day, 365 days a year monitoring system
• Escalation procedures in the event of an incident
• Regular operational reviews and improvements

4. Integration with Other Security Measures Examples:

• Integration with SIEM (Security Information and Event Management)
• Automated response with SOAR tools
• Align with threat intelligence

Streamlining IDS/IPS Operations with SOC Services

The effective operation of an IDS/IPS requires a high level of expertise and 24-hour monitoring. By leveraging SOC (Security Operation Center) services, you can get the following benefits:

1. Expert Monitoring and Analysis

• Experienced Analysts: Advanced analysis by security experts
• Threat intelligence leverage: Detect based on the latest attack intelligence
• Rapid determination: Quickly identify false positives and true threats

2. 24 hours a day, 365 days a year

• Real-time monitoring: Continuous monitoring regardless of late night or holiday
• Immediate Initial Response: Rapid initial response when an incident occurs
• Escalation: Appropriate reporting and response based on severity

3. Continuous Improvement

• Tuning: Continuous optimization according to the environment
• Threat Analysis: Analyze attack trends and plan countermeasures
• Reporting provided: Periodic security posture reports

Summary: Comprehensive Security with IDS/IPS

IDS/IPS is an essential security technology in modern corporate networks. Combined with Firewall and WAF, you can build a comprehensive security posture with defense-in-depth defense.

Key points for effective IDS/IPS utilization:

1. Choose the right technology: Choose the best IDS/IPS solution for your environment
2. Strategic Placement: Effective Placement Considering Network Configuration
3. Continuous Operation: Proper Tuning and Monitoring Based on Expertise
4. Aligning with Other Technologies: Positioning it as part of a comprehensive security strategy

In particular, the use of SOC services is effective in solving operational issues. 24-hour monitoring by experts and proper tuning can reduce operational burden while maintaining security levels.

Colorkrew Security's SOC services include Trend Micro's Cloud One - Endpoint and Workload Security, Azure Firewall, and We provide support for the introduction and operation of IDS/IPS!

If you are a company looking to implement or improve your IDS/IPS operations, or if you want to build a more effective security monitoring system, please contact Colorkrew.

With our extensive experience and expertise, we can help you strengthen your network security.