Having Intrusion Detection System Despite Having Anti Virus and Firewall
Antivirus vs Firewall vs Intrusion Detection System

Having Intrusion Detection System Despite Having Anti Virus and Firewall


My comment on why need an intrusion detection system (IDS) is to prevent intruders from the system. I agree on using IDS, with the more famous, larger, and more important of a corporation's or institution's network, the more IDS is needed. As we enjoy the advance in information communication technology the threat level rises as well. We are no longer on the level of just using the technology but we must now include the security aspect as well. Different from the past our reliance to using the network is high. Almost everyone today store, seek, and exchange informations on The Internet. For us regular users is already a hindrance if we can't use the service, and a stab on the chest if we lose our data. For big companies it's a loss in profit, loss in trust, ultimately could result in destruction of the company. For example when a company makes a deal of $100.000 with the vendor via online, but an abnormality network exist whether infected by a malware, or someone exploits the vulnerability and adds an extra “zero” on the value from $100.000 to $1.000.000. That will result a great loss for the company. This is the fifth assignment from my Masters Advanced Network Security Course which has never been published anywhere and I, as the author and copyright holder, license this assignment customized CC-BY-SA where anyone can share, copy, republish, and sell on condition to state my name as the author and notify that the original and open version available here. melissamaya Today there are many security issues on the network. It's already been 16 years since the Melissa worm epidemic on 1999. Surely threat and security since had greatly advance. For individuals with their personal computer (PC) it's common for them to have anti virus (AV) software to defend themselves against virus' and other malwares. For network administrators firewall is an essential to be configured on the network. Even so there are still missing pieces in AV and firewall. AV scans files, scripts that contains certain pattern of a virus and quarantine it. Firewall configures the authorizations of who can access the network. Then even for a beginner like that have Metasploit could exploit the vulnerability on MS08-067 of late Windows XP if I were in the network. Pure AV will not detect this event because I'm not using a virus to infect a file. A firewall checks the source and the destination of the traffic but cannot analyze of what is inside. The technology the could cope with this is an IDS. ids ips nids hids IDS can be network IDS (NIDS) or host IDS (HIDS). With NIDS equipped on the network which analyzes the packet that comes in and out of the network can detect the exploit that I just execute. IDS is equipped with packet capturer, in Linux it is Libcap. It can also analyze packets, protocols just like Wireshark, formerly known as Ethercap. Then the unique feature of IDS that it can identify known attack patterns when analyzing the packet. It will then produce an alert output that I'm exploiting port 445 SMB on Windows XP. IDS only alerts suspicious activities, if we want it to take action on the suspicious activity, we'd want to use intrusion prevention system (IPS). IPS will act after detection. To put it short, we insert and update known attack patterns in IDS, then it will compare whether the packet pattern match with the attack patterns. IDS will only alert, but IPS will for example block the packet if it matches the attack patterns. A HIDS or HIPS resides on the one host only, a server, or a system. It will monitor the incoming packets and running application whether they are following the policy or not. In other words the HIDS had an ideal expectation of how the application runs and what happens after the packets are received, which then will compare its expectation to how the system is running in reality. For example HIDS will alert when a Firefox browser attemps to create an admin account, while normally Firefox should only function as a browser. A person like me can be behind the scene exploiting the vulnerability of outdated Firefox.
Anti Virus vs Firewall vs Intrusion Detection System

I can conclude that AV and firewall is not enough on a large network because they are not enough to cope when attack patterns are in the network packets. AV and firewall doesn't analyze network packets but IDS or IPS does. That is why I commented that I agree in using IDS or IPS.

Resources

  1. https://0fajarpurnama0.github.io/masters/2020/07/10/intrusion-detection-system-despite-antivirus-firewall
  2. https://0darkking0.blogspot.com/2021/02/having-intrusion-detection-system.html
  3. https://hicc.cs.kumamoto-u.ac.jp/~fajar/masters/intrusion-detection-system-despite-antivirus-firewall
  4. https://0fajarpurnama0.medium.com/having-intrusion-detection-system-despite-having-anti-virus-and-firewall-9dab39221d8
  5. https://steemit.com/technology/@fajar.purnama/having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  6. https://0fajarpurnama0.github.io/masters/2020/07/10/intrusion-detection-system-despite-antivirus-firewall
  7. https://stemgeeks.net/technology/@fajar.purnama/having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  8. https://hicc.cs.kumamoto-u.ac.jp/~fajar/masters/intrusion-detection-system-despite-antivirus-firewall
  9. https://blurtter.com/blurtech/@fajar.purnama/having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  10. https://steemit.com/technology/@fajar.purnama/having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  11. https://0fajarpurnama0.wixsite.com/0fajarpurnama0/post/having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  12. https://stemgeeks.net/technology/@fajar.purnama/having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  13. http://0fajarpurnama0.weebly.com/blog/having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  14. https://blurtter.com/blurtech/@fajar.purnama/having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  15. https://0fajarpurnama0.cloudaccess.host/index.php/9-fajar-purnama-academics/195-having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  16. https://0fajarpurnama0.wixsite.com/0fajarpurnama0/post/having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  17. https://read.cash/@FajarPurnama/having-intrusion-detection-system-despite-having-anti-virus-and-firewall-0d3ebde8
  18. http://0fajarpurnama0.weebly.com/blog/having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  19. https://www.uptrennd.com/post-detail/having-intrusion-detection-system-despite-having-anti-virus-and-firewall~ODU4Mjgx
  20. https://0fajarpurnama0.cloudaccess.host/index.php/9-fajar-purnama-academics/195-having-intrusion-detection-system-despite-having-anti-virus-and-firewall
  21. https://read.cash/@FajarPurnama/having-intrusion-detection-system-despite-having-anti-virus-and-firewall-0d3ebde8
  22. https://www.uptrennd.com/post-detail/having-intrusion-detection-system-despite-having-anti-virus-and-firewall~ODU4Mjgx

How do you rate this article?


5

0

0fajarpurnama0
0fajarpurnama0

I'm a content creator who is interested in financial freedom, decentralization, internet, computer, censorship resistance, unconfiscateable, cryptocurrency, monetization, passive income, and referrals.


Fajar Purnama Academics
Fajar Purnama Academics

This blog contains anything that I wrote in academic sectors which includes essays, homeworks, publications, and reports. The contents unless copyrights are specified are licensed under creative commons attribution customized sharealike (cc-by-sa) where I Fajar Purnama as the creator customized the ShareAlike (sa) license here where you are also allowed to sell my contents but with a condition that you must mention that the free and open version is available here.

Send a $0.01 microtip in crypto to the author, and earn yourself as you read!

20% to author / 80% to me.
We pay the tips from our rewards pool.