UNIT 3

Implementation and Deployment

3.1 Internet Security System’s Real Source

Internet security means securing communication over the internet. It includes specific security protocols such as:

• Internet Security Protocol (IPSec)

It consists of a set of protocols designed by Internet Engineering Task Force (IETF). It provides security at network level and helps to create authenticated and confidential packets for IP layer.

• Secure Socket Layer (SSL)

It is a security protocol. It provides security at transport layer. It addresses the following security issues like Privacy, Integrity and Authentication.

3.2 Snort

• Snort is an open source network intrusion detection system (NIDS) created by Martin Roesch.
• It is a packet sniffer that monitors network traffic in real time, scrutinizing each packet closely to detect a dangerous payload or suspicious anomalies.
• It is based on libpcap (for library packet capture), a tool that is widely used in TCP/IP traffic sniffers and analyzers.
• Through protocol analysis and content searching and matching, Snort detects attack methods, including denial of service, buffer overflow, CGI attacks, stealth port scans, and SMB probes.
• When suspicious behavior is detected, Snort sends a real-time alert to syslog, a separate 'alerts' file, or to a pop-up window.

3.3 NFR Security

• NFR Security offers several products that provides monitoring and intrusion detection capabilities.
• They are designed to be integrated, easily deployed and maintained with each other.
• They provide scalable and flexible solutions that can meet a variety of needs.
• They use the same management interfaces and methods, store data in the same formats, and have similar architectures.

References:

1. Intrusion Detection & Prevention by Carl Endorf, Eugene Schultz and Jim Mellander, TMH.

2.      Implementing Intrusion Detection systems by Tim Crothers, Wiley.