Southern New Hampshire University CYB 310 Project Two Stepping Stone Template Directions: Complete this template by replacing the bracketed text with the relevant information. I. IDS Best Practices Table IDS Component Sensors Database and Storage Central Monitoring Response Report Analysis What Does It Detect? Sensors monitor network traffic, system logs, and other data sources for suspicious activity. They are the first component of an IDS. These sensors can either be host- or network-based. They provide alerts when potential breaches are detected Contains signatures of known attacks and when traffic is detected that matches the signatures it sends out an alert The central console is the IDS component is responsible for receiving and managing warnings from sensors and the analysis engine. The security team can view and manage alerts, investigate problems, and respond appropriately. An IDS should provide a reaction mechanism for dealing with discovered threats to mitigate the effects of the intrusion. This can include restricting traffic, quarantining affected systems, or triggering automated actions. After the sensors generate alerts, the IDS's analysis engine examines them to determine whether they reflect actual threats by various techniques like signature-based detection, anomaly detection, and behavioral analysis. 1 What Could a Threat Actor Accomplish if You Were Not Monitoring This Component? Threat Actors bypass sensor points and can access the network undetected and cause harm to systems and resources Through bad administrative practices and not updating regularly an Attacker can enter the network by using attacks that you have failed to update signatures on If not properly handling alerts or receiving a lot of false alerts the security team might miss a Threat Actor detection and access the network and allow them to cause major damage before detected. Failure in a proper response can allow an Attacker to remain on the network and cause harm if there isn't a process in place to properly mitigate attacks. Through bad review practices a Threat Actor could remain unnoticed and cause harm to the network and resources if administrators aren't actively monitoring their logs. Tenet of the Security (CIA) Triad Most Affected Availability Integrity and Availability Integrity and Availability Availability Availability
Southern New Hampshire University II. Application Question An IDS system is an active and much needed tool in the protection of today's modern network architecture. This is accomplished by providing active and passive monitoring capabilities to administrators. A recommendation for providing a high level of protection would be in the inclusion of a hybrid IDS. As part of the IDS the addition of sensors for detection, database and storage of up to date signatures for comparison to detected anomalies, and strong analytics of reports by administrators on a daily basis would provide a good foundation in protection of the network. 2