topic Re: IDS Location in Network Security

IDS Location

rayroyalmontana — Sun, 10 Mar 2019 11:16:02 GMT

What factors should be considered when deciding where to place an IDS on a network?

Re: IDS Location

rhermes — Tue, 26 Aug 2008 18:13:48 GMT

One of the most important considerations to sensor placement is to place it inside the firewall. This will keep you from looking at events that would have been blocked by your firewall poilcy and allow you to spend your time looking at reall traffic entering your network.

If you use a VPN, placing the sensor on the unencrypted side is good too.

Re: IDS Location

Farrukh Haroon — Tue, 26 Aug 2008 19:10:09 GMT

Another important point is to compare the throughput offered by the throughput with the one to be monitored. Otherwise it could be a real bottleneck for our network. This would also influence your deployment mode (Inline,Promiscuous etc.)

Regards

Farrukh

Re: IDS Location

rayroyalmontana — Wed, 27 Aug 2008 10:21:58 GMT

Can you provide a link to an article about this issue?

Re: IDS Location

Farrukh Haroon — Wed, 27 Aug 2008 13:24:13 GMT

Can you be let us know about which 'issue' do you need the link?

Regards

Farrukh

Re: IDS Location

rayroyalmontana — Wed, 27 Aug 2008 13:33:38 GMT

I was looking for an article about where to place an IDS on a network.

Re: IDS Location

Farrukh Haroon — Wed, 27 Aug 2008 15:25:33 GMT

I'm not aware of any such document on the Cisco website at least. Ill try to write a short description here.

Some places to use Promiscuous mode:

> When you fear that the sensor will be a bottleneck because of its limited throughput (if placed Inline) in each traffic flow.

> You want to protect a server farm subnet, but not all subnets in it. This is sort of related to the first point.

> You are concerned that the sensor deployment is not mature and it might block valid connections (False Negative).

Some places to use Inline mode:

> When you want the IPS to play a more 'active' role in the network and Deny packets as they pass through it. With promiscuous mode it is possible that the attack goes through before the sensor actually goes ahead and 'logs' into the blocking device and block its.

> When you have devices that are not supported for blocking, like non cisco routers etc. you would go for inline

> You want the sensor to have a 'better view' of the network

Some places to use Inline VLAN pair mode:

Same as inine, but you don't have enough physical interfaces to cover all physical segments. Also IDSM-2 is usually deployed in this fashion.

Please rate if helpful.

Regards

Farrukh

Re: IDS Location

kutukutu9 — Wed, 03 Sep 2008 16:48:58 GMT

http://analysisandreview.com/security/ips-ids-install-tune-incident-response-guide/