3 ms·
To any NIDS newbies out there... Please don't deploy this in-line. Ever. You should always have your IDS out-of-band. Software like Snort is great for detecting
by yabones 4y ago
To any NIDS newbies out there... Please don't deploy this in-line. Ever. You should always have your IDS out-of-band. Software like Snort is great for detecting threats, but if you block every "threat" you're going to have a bad time. Not to disparage the quality of their rulesets, they are very high quality, but there absolutely will be false positives. I've spent many evenings and weekends troubleshooting IPS problems, 0/10 cannot recommend.
The best option is to mirror all traffic from switches directly to capture boxes where the detection and logging happens. This should be sent to a central system that has a full picture of the network and traffic patterns. That central system should be the one making the decisions, and it should be very smart. Automatic firewall rules should be close to the source, and shutdown switchports should be close to the client.
For safe IPS operation there needs to be several layers of filters, not just a list of "allowed rule IDs". This is the sort of project that takes at least a year to fully roll out - it's not the kind of thing a "security whiz" can set up in an afternoon.
At best, it can be a very useful diagnostic, logging, and threat detection tool. At worst, it can cause very difficult to predict and troubleshoot network problems.
- nubb 4y agogreat comment. thing i’d add for folks who want to play with this, follow this setup exactly and turn every rule on but don’t perform any blocking. then review the logs and dial back unnecessary rules. very “fun” exercise in a lab for a student xD
- slt2021 4y agoor just use commercial NGFW which uses combination of ASIC and specialized compute cores to decrypt and inspect traffic inline and block threats. They are very capable, but very expensive
- cosmotic 4y agoCan confirm. I just spent many hours trying to diagnose why an API was timing out. Turns out Snort blocked the IP address of the certificate authority which chrome was secretly using to verify the API's certificate. My local machine had the verification cached but the docker container I was using did not. No indication of what was going on in the top-level network tools; I had to use the hard-to-find network diagnostics recorder in Chrome to even realize chrome was connecting to the certificate authority.
- bks 4y agoThis reminds me of when I used to run http://snortinline.com/ http://snortinline.com/ in 2004 - when having the IDS inline seemed quite cool.
- INTPenis 4y agoThis is why we have a SOC where I work. A group that processes alerts and dispatch actions if necessary.