Intrusion detection and prevention learning guide

TABLE OF CONTENTS

   Introduction to Intrusion Detection and Prevention Systems
   IDS/IPS Architecture
   Wireless Intrusion Detection
   IDS/IPS Implementation and Placement
   Troubleshooting and False Positives
   Snort and Other Sniffers
   Product Reviews and Buying Advice
   The Future of Intrusion Detection and Prevention
   More Security Learning Resources
   Free Security IT Downloads

Introduction to Intrusion Detection and Prevention Systems

Return to Table of Contents

• Glossary Definition: Intrusion detection (SearchNetworking.com)
• Glossary Definition: Intrusion prevention (SearchNetworking.com)
• Tip: Intrusion detection basics (SearchSecurity.com)
• Tip: Common security measures (SearchNetworking.com)
• Quiz: Intrusion detection and prevention systems (SearchSecurity.com)
• Quiz: Intrusion-prevention systems (SearchSecurity.com)
• Advice: The ABCs of intrusion detection (SearchSecurity.com)
• Advice: How do intrusion detection systems work? (SearchNetworking.com)
• Book Chapter: The Tao of Network Security Monitoring, Beyond Intrusion Detection, Chapter 11 (SearchNetworking.com)
• Featured Topic: IDS best practices (SearchSecurity.com)
• Tutorial: A walk-through of an attack (SearchNetworking.com)
• Webcast: Five steps to IDS success (SearchSecurity.com)

IDS/IPS Architecture

Return to Table of Contents

• Article: Hybrid honeypots 'shadow' intrusion prevention systems (SearchSecurity.com)
• Article: Signature-based threats: Moving beyond 'picking off penguins' (SearchSecurity.com)
• Column: The preconditions for next-generation security (SearchNetworking.com)
• Tip: IDS: Signature versus anomaly detection (SearchSecurity.com)
• Tip: Bridging the gap between perimeter and host security (SearchSecurity.com)
• Tip: Battling worms with network-based IPS (SearchSecurity.com)

Wireless Intrusion Detection

Return to Table of Contents

• Tip: Beyond wireless intrusion detection (SearchNetworking.com)
• Tip: Wireless LAN intrusion detection (SearchSecurity.com)
• Tip: Managing Wi-Fi stations (SearchNetworking.com)
• Tip: Why distributed wireless IDS is needed (SearchSecurity.com)
• Tip: Signs of WLAN intrusion (SearchNetworking.com)
• Q&A: Wireless IDS, a crucial part of your security strategy (SearchSecurity.com)
• Review: AirMagnet Enterprise 5.0 steps up wireless IDS (SearchSecurity.com)

IDS/IPS Implementation and Placement

Return to Table of Contents

• Q&A: Tips for maximizing the effectiveness of IDS/IPS (SearchSecurity.com)
• Tip: Maximizing IDS/IPS implementations (SearchSecurity.com)
• Tip: Evaluating and tuning an intrusion detection system (SearchSecurity.com)
• Tip: Where to place IDS sensors (SearchSecurity.com)
• Tip: Troubleshooting firewalls (SearchNetworking.com)
• Advice: Implementing IDS in small- to medium-sized businesses (SearchSecurity.com)
• Webcast: Secrets to using IDS and IPS effectively (SearchSecurity.com)

Troubleshooting and False Positives

Return to Table of Contents

• Glossary Definition: False positive (SearchNetworking.com)
• Article: New semantics-aware IDS reduces false positives (SearchSecurity.com)
• Q&A: Tips for maximizing the effectiveness of IDS/IPS (SearchSecurity.com)
• Tip: How to limit false positives in IPSes (SearchSecurity.com)
• Tip: Target-based IDS muffles the noise to take aim on the alerts that count (SearchSecurity.com)
• Tutorial: A walk-through of an attack (SearchNetworking.com)

Snort and Other Sniffers

Return to Table of Contents

• Glossary Definition: Snort (SearchSecurity.com)
• Glossary Definition: Sniffer (SearchNetworking.com)
• Article: Sniffer spinoff: Sign of weakness or opportunity? (SearchNetworking.com)
• Article: Sourcefire offers Snort certification and online training (SearchSecurity.com)
• Article: Sniffer update has a nose for data capture (SearchNetworking.com)
• Advice: What is a sniffer? (SearchNetworking.com)
• Advice: What's the difference between packet "sniffers" and protocol analyzers? (SearchNetworking.com)
• Tip: How to determine how many interfaces a sensor needs (SearchSecurity.com)
• Tip: What OS to use for Snort sensors (SearchSecurity.com)
• Tip: How to deal with switches and segments (SearchSecurity.com)
• Tip: Why Snort makes IDS worth the time and effort (SearchSecurity.com)
• Tip: How to verify that Snort is operating (SearchSecurity.com)
• Tip: How to automatically update Snort rules (SearchSecurity.com)
• Tip: Where to find Snort rules (SearchSecurity.com)
• Tip: How to decipher the Oinkcode (SearchSecurity.com)

Product Reviews and Buying Advice

Return to Table of Contents

• Review: Enterasys's Dynamic Intrusion Response is a 'hot' IPS (SearchSecurity.com)
• Review: Tripwire Enterprise provides robust, intrusion reporting (SearchSecurity.com)
• Review: AirMagnet Enterprise 5.0 steps up wireless IDS (SearchSecurity.com)
• Review: Products of the Year: Intrusion detection systems (SearchSecurity.com)
• Review: Products of the Year: Intrusion prevention systems (SearchSecurity.com)
• Review: Sentivist IPS (SearchSecurity.com)
• Article: Open-source IPS testing tool released (SearchSecurity.com)
• Advice: Choosing the 'hottest' IPS on the market (SearchSecurity.com)

The Future of Intrusion Detection and Prevention

Return to Table of Contents

• Article: A human connection to intrusion detection (SearchSecurity.com)
• Article: Will intrusion prevention ever live up to its promise? (Information Security magazine)
• Tip: Next-generation intrusion prevention: Defense before, during and after the attack (SearchSecurity.com)
• Book Chapter: The future of intrusion detection and prevention (SearchSecurity.com)
• Presentation: Advanced intrusion defense (SearchSecurity.com)
• Featured Topic: Intrusion defense (SearchSecurity.com)

More Security Learning Resources

	SECURITY SCHOOL		LEARNING GUIDES		CHECKLISTS		GLOSSARY		ASK THE EXPERTS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Network Intrusion Detection (IDS) What are best practices for creating an IDS and maintaining a signature database? Network intrusion prevention systems: Should enterprises deploy now? RSA 2008: Sourcefire founder Roesch previews Snort 3 Screencast: Opening up the Network Security Toolkit Can a firewall alone effectively block port-scanning activity? Should an intrusion detection system (IDS) be written using Java? What security risks do enterprise honeypots pose? What are the benefits of 'in-the-cloud' network security services? Screencast: Snort -- Tactics for basic network analysis Can Snort stop application-layer attacks? Network Intrusion Detection (IDS) Research Network Intrusion Prevention (IPS) Network intrusion prevention systems: Should enterprises deploy now? What security risks do enterprise honeypots pose? What are the benefits of 'in-the-cloud' network security services? What is a 'top-down' IPS sensor search? Is a 'self-defending network' possible? Best practices for purchasing an intrusion detection device VeriSign, AirMagnet team up for wireless IPS Sourcefire, Nmap deal to open vulnerability scanning Interop: Vendors update software, demonstrate new security features McAfee launches IPS for 10g networks, but is IT ready? Network Intrusion Prevention (IPS) Research

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary computer forensics  (SearchSecurity.com) Diffie-Hellman key exchange  (SearchSecurity.com) Einstein  (SearchSecurity.com) HIDS/NIDS  (SearchSecurity.com) intrusion detection  (SearchSecurity.com) network behavior analysis  (SearchSecurity.com) ultrasound  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary