IPS/HIPS provide for an increased level of protection not available from a static access list or stateful firewall inspection. IPS and HIPS offer security by sensing abnormalities in traffic communications or protocol, and packet behaviors that are known to have malicious objectives. Here are some recommendations for installing and hardening your IPS sensors: | Global Knowledge Expert Reference Series ofWhite Papers Cisco Security Setup Configuration Part 3 Network Host-Based IPS 1-800-COURSES Cisco Security Setup Configuration Part 3 Network Host-Based IPS Isaac A. Valdez Global Knowledge Instructor CCSI CCSP CCNP CCDP Introduction This paper is the third in a three-part series of white papers each of which focuses on a functional area of securing your network. So far we have a perimeter router secured and configured with interface Access Control Lists ACLs . We also have a firewall using stateful inspection and switches in between controlling our ports for secure end station connectivity. This all sounds very impressive and complete but is it Of course not or this white paper series would be complete. The problem is that routers firewalls and switches aren t always enough. There are still attacks out there that travel over valid client requests and responses. These attacks would be permitted by our perimeter ACLs and stateful firewalls. Or perhaps a worm infects an end station and tries to propagate throughout our network. Maybe even some of our own end-users decide to chew up all of our bandwidth downloading Spider Man II using Bit Torrent. In all of these situations static ACLs or even stateful firewalls would not be enough. That is where we install configure and use Network- and Host-based Intrusion Prevention Systems IPS . IPS HIPS IPS HIPS provide for an increased level of protection not available from a static access list or stateful firewall inspection. IPS and HIPS offer security by sensing abnormalities in traffic communications or protocol and packet behaviors that are known to have malicious objectives. Here are some recommendations for installing and hardening your IPS sensors Allowing for a sufficient discovery period prior to sensor installation is a key item often overlooked. Many environments simply try to rack and stack a sensor give it a quick IP address and let it do its thing.
