Duration
5 days
Overview
Cyber threats are increasing at an alarming rate every year and the ability for organizations to defend against full-scaled distributed attacks quickly and effectively is becoming more and more difficult. In order to be safe and secure on today's Internet, organizations must learn to become more automated. This means being capable of characterizing attacks across hundreds or even thousands of IP sessions and improving their ability to recognize attack commonalities. With intrusion detection systems and trained network security auditors, organizations have a reliable means to prioritize, and isolate only the most critical threats in real time.
Course Objectives
- Identify the best defensive measures to effectively protect a network
- Setup and maintain an intrusion detection system
- Conceptualize and develop intrusion detection rules and rule sets
- Analyze and respond to intrusion attempts
- Recover from a successful intrusion
Prerequisites
- A thorough understanding of Microsoft Windows
- Knowledge of networking protocols and Wireshark filtering is highly recommended
Course Outline
- 1. Cyber Threat Overview
- Intrusions Defined
- Historical Intruders
- Historical Intrusions
- Wireshark Overview
- TCP Session Initialization Review
- Incident Response
- 2. NetFlow Analysis
- Cisco NetFlows Ver 1 - Ver 9 (IPFIX)
- SFlows
- JFlows
- Silk and Argus Collectors
- 3. Intrusion Detection Systems
- Definition
- IDS Types
- Scanning versus Compromise
- IDS Known Good vs. Known Bad Approaches
- Rule Based IDS
- Heuristics Based IDS
- Response Actions
- Inline IDSs
- Problems with Active Response
- Defense in Depth
- False Positive and False Negatives
- 4. Intrusion Prevention Systems
- Active Response Techniques
- 5. Introduction to SNORT
- Packet Sniffer
- Packet Logger
- NIDS
- Protocol Support
- Sourcefire
- Packer Decoder
- Preprocessors
- Detection Engine
- Alert and Logging
- 6. Detection Rules
- Actions After a Match
- What Rules Can't Do
- Fundamentals of a Rule
- Rule Actions
- Rule Body Options
- Content Modifiers
- Pre-Processors
- Output Plug-ins
- 7. Attack Scenarios
- Writing Signatures
- 8. Syslog Tools
- Kiwi SyslogD Server Setup
- 9. Non Payload Detection Rules
- Dsize
- Fragoffset
- TT1
- TOS
- ID
- IPOpts
- Fragbits
- Flags
- Flow
- Flowbits
- Seq
- Window
- 10. Post-Detection Rule Options
- Logto
- Session
- Resp
- React
- Tag
- 11. Writing Effective Snort Rules
- Content Matching
- Catch Vulnerabilities
- Oddities of the Protocol
- 12. Optimizing IDS Rules
- 13. Attack Scenarios
- Writing Signatures
- 14. Student Practical Demonstration
- You will be given five attack scenarios in which you will need to write Snort rules to defend against. Once you have implemented the rules in your Snort System, the instructor will launch attacks against them to determine if your rules were effective.
Programme scope, delivery arrangements and suitability are confirmed during enquiry.