Cybersecurity Landscape
“Hackers Hone their Skills While Consumers Remain Complacent,”
​
(Symantec, in a November 2016 press release.)
-
Surprisingly, 76 percent of consumers in 21 countries acknowledge the importance of keeping their account information secure, yet many still share their passwords, among other risky behaviors with their data. A further 35 percent allow at least one device to go unprotected and vulnerable to all forms of viruses and malware. (Source: Symantec)
Cybersecurity Trends Spotlight Report (2017) [PDF]
The average ransomware demand also increased significantly, from $294 in 2015 to $1,077 in 2016.
​
(Source: Symantec)
43 percent of cyber attacks against businesses worldwide target small companies.
Cyber-criminals will increasingly use artificial intelligence and machine learning to conduct attacks.
​
(Source: Symantec)
More about how Intrusion Detection & Intrusion Prevention works.
An intrusion detection software basically checks for changes that are made by unwanted programs that could be injected into your systems by cyber criminals.
All of them study the data packets – incoming and outgoing – to see what kind of data is being transferred and alerts you in case it finds any kind of suspicious activities on the computer or network.
There are many intrusion detection software available in market. The functioning of different software depend upon how they are coded, but most of them check data packet signatures, changes made to computer registry or other areas of interest such as startup programs, format of data packets etc so that that they can trace possible intrusions on behalf of cyber criminals.
Intrusion detection software are of two types. One is the Host-based intrusion detection system and the other is Network-based intrusion detection system. The network-based intrusion detection system relies on data packets travelling on the network to make sure everything is alright. It works by comparing data packets by known types of attacks and by finding out irregularities in data packets travelling on the network. Examples of anomalies could be missing signatures, improper type of data packet etc.
The host-based intrusion system relies more on system settings to see if there is any kind of compromise or if any software is trying to force changes on your computer or computer network.
​
​
​
Classifications
Intrusion prevention systems can be classified into four different types:
1.Network-based intrusion prevention system (NIPS): monitors the entire network for suspicious traffic by analyzing protocol activity.
2.Wireless intrusion prevention systems (WIPS): monitor a wireless network for suspicious traffic by analyzing wireless networking protocols.
3.Network behavior analysis (NBA): examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware and policy violations.
4.Host-based intrusion prevention system (HIPS): an installed software package which monitors a single host for suspicious activity by analyzing events occurring within that host.
Detection methods
The majority of intrusion prevention systems utilize one of three detection methods: signature-based, statistical anomaly-based, and stateful protocol analysis.
1.Signature-Based Detection: Signature based IDS monitors packets in the Network and compares with pre-configured and pre-determined attack patterns known as signatures.
2.Statistical anomaly-based detection: A statistical anomaly-based IDS determines the normal network activity —like what sort of bandwidth is generally used, what protocols are used, what ports and devices generally connect to each other— and alerts the administrator or user when traffic is detected which is anomalous (not normal).
3.Stateful Protocol Analysis Detection: This method identifies deviations of protocol states by comparing observed events with “predetermined profiles of generally accepted definitions of benign activity.