ccna 5 day bootcamp

ccna 5 day bootcamp.When a feature generates an alert, it is difficult to correspond that alert to a specific attack because the alert simply indicates that abnormal traffic is being detected. More analysis is needed here to determine if a real attack has occurred on the traffic and what attack has actually been completed. Also, if the attack traffic happens to be very similar to normal traffic, then the attack may escape detection.5.2.2.4 Policy-Based DetectionPolicy-based detection, also called behavior-based detection, is similar to pattern-based detection, but instead of trying to define particular patterns, it is up to the administrator to define suspicious behavior based on historical analysis.The behavior-based detection approach covers an entire class of attack activity with a single feature, without having to specifically target individual situations. For example, having a feature that can now trigger behavior when an email client calls cmd.exe will let an administrator apply this feature to any application whose behavior is similar to the basic features of the email client, rather than applying the feature to each client application individually. Thus, if a particular user installs a new email application, the feature still applies.Honeypot-based detection Honeypot-based detection uses a fake (dummy) server to attract attacks. The purpose of the honeypot approach is to divert the attack away from the real network device. With different types of vulnerabilities in the honeypot server, administrators can analyze the types of incoming attacks and the malicious traffic patterns. They can then use the results of this analysis to adjust sensor characteristics to detect new types of malicious network traffic. Honeypot systems are rarely used in production networks. Anti-virus and other security vendors like to use it for research purposes.5.2.2.5 Benefits of Implementing IPSCisco has implemented IPS functionality in its CiscoIOS software. CiscoIOSIPS uses technology from the CiscoIDS and IPS sensor product lines, which include the CiscoIPS 4200 and the newer IPS 4300 series sensors, and the Cisco Catalyst 6500 series Intrusion Detection System Service Module (IDSM-2).130 Chapter 5 Implementing Intrusion PreventionThere are many advantages to using the CiscoIOSIPS solution. It uses the underlying routing infrastructure to provide an additional layer of security.Because CiscoIOSIPS is inline and supported by many routing platforms, it can effectively mitigate attacks by denying malicious traffic from inside and outside the network.