An IDS can only detect an attack. It will respond after detecting an attack, and IDS responses can be either passive or active. If you’re planning to take the Security+ exam, you should have a basic understanding of appropriate tools and techniques to discover security threats and vulnerabilities.
For example, can you answer this question?
Q. A security company wants to gather intelligence about current methods attackers are using against its clients. What can it use?
A. Vulnerability scan
B. Honeynet
C. MAC address filtering
D. Evil twin
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
IDS Responses
An IDS will respond after detecting an attack, and the response can be either passive or active. A passive response primarily consists of logging and notifying personnel, whereas an active response also changes the environment to block the attack:
- Passive IDS. A passive IDS logs the attack and may also raise an alert to notify someone. Most IDSs are passive by default. The notification can come in many forms, including an email, a text message, a pop-up window, or a notification on a central monitor.
- Active IDS. An active IDS logs and notifies personnel just as a passive IDS does, but it can also change the environment to thwart or block the attack. For example, it can modify access control lists (ACLs) on firewalls to block offending traffic, close processes on a system that were caused by the attack, or divert the attack to a safe environment, such as a honeynet or honeypot.
Remember this
Honeypots and honeynets attempt to divert attackers from live networks. They give security personnel an opportunity to observe current methodologies used in attacks, and gather intelligence on these attacks.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Counterattacks
An active response IDS would rarely perform a counterattack against the attacker. Some network security professionals specialize in attacks or counterattacks, but regular administrators should avoid them.
Consider basic human nature. If one person bumps into another in a crowd, the second person could simply ignore it or give a smile and a nod indicating “no problem,” and the event is over. On the other hand, if the response is an aggressive push accompanied by some loud words, the event escalates. It can turn ugly quickly. Now, compare this to some basic facts about attackers today:
- Attackers are dedicated. Attackers aren’t just bored teenagers passing their time away like Matthew Broderick in the movie War Games. Most attackers today are dedicated criminals working in a semiskilled profession. This is similar to a seasoned car thief with specific skills to break into and steal cars. They are often very good at what they do. Attackers’ skills steadily increase, and their tools are becoming more and more sophisticated.
- Attackers have unlimited time. Attackers usually have the luxury of spending 100 percent of their time on attack strategies and methodologies. Compare this with network administrators, who have a host of other duties and rarely can spend 100 percent of their time on security.
Many administrators certainly have the expertise to investigate an attack, trace an IP address back, and launch a counterattack. However, just because you can doesn’t mean you should. The attacker will likely detect the counterattack and escalate the attack. Instead of moving on from your network, the attacker might take your attack personally and consider it a lifelong mission to cripple your network.
It’s also highly likely that the attacking IP address is not the actual attacker. Very often, attackers hijack the machines of unwitting users and launch attacks from their systems. If you counterattack, you could be attacking the wrong computer.
Q. A security company wants to gather intelligence about current methods attackers are using against its clients. What can it use?
A. Vulnerability scan
B. Honeynet
C. MAC address filtering
D. Evil twin
Answer is B. A honeynet is a fake network designed to look valuable to attackers and can help security personnel learn about current attack methods. In this scenario, the security company can install honeynets in its customers’ networks to lure the attackers.
A vulnerability scan detects vulnerabilities, but attackers may not try to exploit them.
Media access control (MAC) address filtering is a form of network access control, but can’t be used to detect or learn about attacks.
An evil twin is a rogue access point with the same SSID as an authorized access point.
