IPS - Implementing Cisco Intrusion Prevention System

Objectives

In diesem Kurs lernen Sie den Einsatz einer IPS Lösung für die verschiedenen Unternehmensnetze kennen.

Der Kursinhalt beschäftigt sich mit der Implementierung des Sensors im Netzwerk (Design), der Konfiguration und das Anpassen des Sensors im Netzwerk, Konfiguration des Sensors, dem Cisco Event Viewer (IEV), Auswertung von Events und Reporting.

Hinweis:

Dieser Kurs bereitet Sie auf die Cisco Certfied Network Professional for Security (CCNP Security) Zertifizierung vor. Erforderlich für die Händler-Akkreditierung zum Cisco Security Specialist Partner und zum Cisco Advanced Security Specialist Partner.

Target audience

• Netzwerkadministratoren und Techniker, die Cisco Network Security Produkte installieren und verwalten sollen
• Kandidaten für die CCNP Security Zertifizierung

Requirements

• Erfahrung mit der Konfiguration der Cisco IOS Software
• Gute Kenntnisse vom TCP/IP Stack in der LAN/WAN Umgebung
• Betriebssysteme (z.B. Windows) Basiskenntnisse 
• Kenntnisse im Netzwerk-/Security-Umfeld im speziellen Angriffe und Attacken aus dem Netzwerk
• Empfohlen wird der Besuch des Kurs IINS - Implementing Cisco IOS Network Security

Agenda

Introduction to Intrusion Prevention and Detection, Cisco IPS Software, and Supporting Devices

• Evaluating Intrusion Prevention and Intrusion Detection Systems
• Choosing Cisco IPS Software, Hardware, and Supporting Applications
• Evaluating Network IPS Traffic Analysis Methods, Evasion Possibilities, and Anti-Evasive Countermeasures
• Choosing a Network IPS and IDS Deployment Architecture

Installing and Maintaining Cisco IPS Sensors

• Integrating the Cisco IPS Sensor into a Network
• Performing the Cisco IPS Sensor Initial Setup
• Managing Cisco IPS Devices

Applying Cisco IPS Security Policies

• Configuring Basic Traffic Analysis
• Implementing Cisco IPS Signatures and Responses
• Configuring Cisco IPS Signature Engines and the Signature Database
• Deploying Anomaly-Based Operation

Adapting Traffic Analysis and Response to the Environment

• Customizing Traffic Analysis
• Managing False Positives and False Negatives
• Improving Alarm and Response Quality

Managing and Analyzing Events

• Installing and Integrating Cisco IPS Manager Express with Cisco IPS Sensors
• Managing and Investigating Events Using Cisco IPS Manager Express
• Using Cisco IME Reporting and Notifications
• Integrating Cisco IPS with Cisco Security Manager and Cisco Security MARS
• Using the Cisco IntelliShield Database and Services

Deploying Virtualization, High Availability, and High Performance Solutions

• Using Cisco IPS Virtual Sensors
• Deploying Cisco IPS for High Availability and High Performance

Configuring and Maintaining Specific Cisco IPS Hardware

• Configuring and Maintaining the Cisco ASA AIP SSM and AIP SSC Modules
• Configuring and Maintaining the Cisco ISR IPS AIM and IPS NME Modules
• Configuring and Maintaining the Cisco IDSM-2 Module

Labs

• Lab 2-1: Performing the Cisco IPS Sensor Initial Setup
• Lab 2-2: Managing a Cisco IPS Sensor
• Lab 3-1: Configuring and Modifying Basic Cisco IPS Signatures and Responses
• Lab 3-2: Configuring Cisco IPS Anomaly-Based Operation
• Lab 4-1: Configuring Custom Cisco IPS Signatures
• Lab 4-2: Managing False Positives and False Negatives
• Lab 4-3: Improving Alarm and Response Quality
• Lab 5-1: Using the Cisco IME
• Lab 5-2: Using Cisco IPS and Security Intelligence Web Resources
• Lab 6-1: Configuring Policy Virtualization