Intrusion detection system

Post-traffic mirroring is very powerful and it is pretty good for a few specific scenarios.

For example, I can think of ways, content inspection, so you can run your IDS IPS tool, you can do threat hunting, you can capture the full traffic when you suspect that there's a compromise instance so you you don't want to touch the production flow you can use this traffic mirroring and you can actually see what's going in and out during real-time attack scenario it and it doesn't read out or delay any original packets as well so your production traffic is not affected by this mirroring session so if you compare it it's like if you are if you are from the telecom background or if you are not then i can give you an example We used to have something called call details where you can see who called whom during a particular time and how much time that call lasted.

So that's something which can be compared as a VPC flow log.

But then again, for a specific scenario, you can actually get recording of POSA.

This was an E inval from the NIOC control ioctl on dev netmap.

The /r suffix meant Rx rings only, which is what Suricata requests in intrusion detection system or IDS mode.

In IDS mode, Suricata observes packets and raises alerts, but unlike an intrusion prevention system like an IPS, it does not block them." Oh, yeah.

"This post is the war story of getting from that unhelpful error no to the real problem.

Adjusting Suricata blindfolded.

It's like medieval castle with layers of walls, moats, and gates.

This strategy includes physical, which is locks and cameras; network, which is firewalls, IDS; host, which is antivirus and patching; and then application, like secure coding; and then data via encryption layers.

The idea is to slow down attackers, reduce single point of failures, and increase the chances of detecting a breach early.

Defense in depth ensures that even if one defense fails, other can slow down or stop the attacker, creating a multilayer barrier against sophisticated cyber threats.

That's, uh, that is a key administrative preventative control.

Detective controls are like watchtowers scanning for intruders, identifying the breaches as they occur, right? Real-time monitoring.

So IDS, Splunk, NetFlow, UBA, this is all, this is all, uh, examples of detective controls.

Corrective controls are contingency plans, so the processes that help to recover quickly if a breach occurs.

Oh, absolutely.

And we have intrusion detection systems, or IDS, sitting on these CAN and Ethernet buses inside the car.

If a piece of rogue firmware starts behaving badly, say trying to access a memory register it shouldn't or flooding a network segment, the IDS should catch it, right?

Well, ENISA's good practices categorize the ease of detection for this kind of attack at the back end as medium.

Okay, medium.

Because remote servers possess massive computational resources for advanced monitoring.

And locally, a vehicle-level IDS is indeed designed to spot anomalous behavior.

But?

That's really what we're talking about.

Well, and I was also thinking this is very similar to IDS IPS, right? You don't just jump straight to IPS, right? You don't just cut things off.

You start looking at detection.

You start analyzing.

I think Joe has indelibly put that there.

So, your organization suspects an attacker is using some new techniques that don't match any of the existing IDS IPS signatures, but You have NetFlow data, you have the DNS logs, you have authentication logs, and you have endpoint telemetry.

So what's your research strategy for beginning to figure out how to craft a new IDS or IPS signature for this?

Well, you put a lot of emphasis on endpoint, so maybe I'll start there.