By Elias Georgiou – System Consultant
What is IPS?
IPS stands for Intrusion Prevention Systems which are network security/threat mechanisms that perform inline scanning to all network traffic in order to detect and ultimately prevent vulnerability exploits or attacks. Such exploits that come in the form of malicious inputs have as a goal to gain control or interrupt applications or machines.
Intrusion Prevention Systems continuously monitor the network looking to identify possible malicious activities, record information about them, report any detected threats to network administrators and take preventative measures to block a threat from causing any harm. Such preventative measures could be closing access points or configuring firewalls to block any future attacks as well. Intrusion Prevention Systems can also be used to identify issues with company security policies discouraging employees or network guest from violating these policies again.
Nowadays network attackers are becoming more and more sophisticated and can penetrate even the most robust security solutions so IPS have become a key component of all major infrastructures in modern organizations.
How do Intrusion Prevention Systems work?
Intrusion Prevention Systems work by actively scanning all network traffic for known attack patterns or malicious activities which include Denial of Service (DOS) attack, Distributed Denial of Service (DDOS) attack, different types of exploits or viruses. To achieve this Intrusion Prevention Systems are typically placed behind a Firewall, acting as an additional security layer that performs real time packet inspection. Upon detecting any malicious or suspicious packets the below actions will take place:
Types of Intrusion Prevention Systems
Most of the Intrusion Prevention Systems use one of the three methods - Signature based, Statistical Anomaly based or Stateful Protocol analysis detections.
Configure IPS Sensors on FortiGate
Fortinet delivers IPS technology via the industry validated and recognized FortiGate platform. FortiGate security processors provide unparalleled high performance, while FortiGuard Labs informs industry leading threat intelligence, creating an IPS with proven success in protecting from known and zero-day threats. As a key component of the Fortinet Security Fabric, FortiGate IPS secures the entire end-to-end infrastructure without compromising performance.
To create a new IPS sensor
Figure 1: depending on the FortiGate model there are many predefined IPS sensors as well
Figure 2: when creating a new sensor, you can add IPS signatures, IPS filters or Role Based Signatures
A newly created sensor is empty and contains no filters or signatures. You need to add one or more filters or signatures before the sensor will be of any use.
To create a new Pattern Based Signature and Filter
Figure 3: create a custom filter or select one of the predefined filters
The filter is created and added to the filter list. The same process can be followed in order to create or add an IPS Signature to an IPS sensor.