Intrusion Detection and Prevention with Suricata: Cybersecurity Lab Scenario
"Explore a hands-on lab scenario for intrusion detection and prevention using Suricata in the realm of cybersecurity. Learn how to set up Suricata as an IDS and IPS to secure your network against various attacks."
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Cybersecurity (Security+) and P4 Programmable Switches Lab 14: Intrusion Detection and Prevention using Suricata Ali AlSabeh, Jorge Crichigno University of South Carolina http://ce.sc.edu/cyberinfra Western Academy Support and Training Center (WASTC) University of South Carolina (USC) Energy Sciences Network (ESnet) June 21st, 2023 1
Attack Scenario Using the BR/FW as a Suricata IDS to send alerts upon matching ICMP packets destined to the DNS server Using the BR/FW as Suricata IPS to drop ICMP packets destined to the mail server Using the BR/FW as a Suricata IDS to send alerts upon matching TCP SYN packets destined to the DNS server Using the BR/FW as a Suricata IPS to prevent SYN flood attack against the DNS server 3
Suricata as IDS for ICMP Alerts Adding a new custom rule file to Suricata configuration file Adding a new rule to alert ICMP packets destined to the DNS server 5
Suricata as IPS for ICMP Drops Adding a new rule to drop ICMP packets destined to the mail server Pinging the DNS server Pinging the mail server 6
Suricata as IDS for TCP SYN Alerts Adding a new custom rule file to Suricata configuration file Adding a new rule to alert TCP SYN packets destined to the DNS server 7
Suricata as IPS for TCP SYN Flood Attack Adding a new rule to limit the rate of TCP SYN packets destined to the DNS server servers 8
Suricata as IPS for TCP SYN Flood Attack Inspecting the network usage on the DNS server under TCP SYN flood attack Inspecting the network usage on the mail server under TCP SYN flood attack 9
